hxxps://www[.]youtube[.]com/

Analysis

max time kernel
968s
max time network
972s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{4A039097-254B-4867-A864-F962DB001CB8}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{B94F5393-BAC2-44FC-87F5-7CE1FD291A86}	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
1148	msedge.exe
1148	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
388	msedge.exe
388	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
2108	msedge.exe
2108	msedge.exe
4212	msedge.exe
4212	msedge.exe
5948	identity_helper.exe
5948	identity_helper.exe
5572	msedge.exe
5572	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2148	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2148	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 4032	1148	msedge.exe	83
PID 1148 wrote to memory of 4032	1148	msedge.exe	83
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 1236	1148	msedge.exe	84
PID 1148 wrote to memory of 2012	1148	msedge.exe	85
PID 1148 wrote to memory of 2012	1148	msedge.exe	85
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86
PID 1148 wrote to memory of 1284	1148	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb263f46f8,0x7ffb263f4708,0x7ffb263f4718
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8983620733197370492,3334454165058507068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x4c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb263f46f8,0x7ffb263f4708,0x7ffb263f4718
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,10248673945196041182,11607266143313176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
57967a160519052941fce6b35b105aa8

SHA1
132fefe10085c4d7c7959f25cb0dfc59ec73dedc

SHA256
b18dfd4e55ca1c6cd4e66418b5e01a5dc64a1a5866e82c079b3bf4abadb65614

SHA512
5e08dc1e702c958df415f00ae4299c9b9ca5fbd005a2c53ce02fb203d9759444883d3561ae6fcb8584a136511710fe24eefd31562ca2e4c1909e5edeac8a3ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
39KB

MD5
c3937a77b27f7fce8c19ca54200295c6

SHA1
f3a460eb84d33b52080f459eb6d6a075b65ad7a8

SHA256
780962e464fef6215639d410e69ce56c78cb47fff312afb07bcc74f13d369851

SHA512
025c4eb1e88511e4ae3e1829bf85149b1aadd96656fd8f071e9388962dbe5b695399790f1f3fbe4ce547d754e1de6f218f5f1107ed91419566729aaf39e97085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
1.2MB

MD5
153d9573f0f824b040ac13793d95e406

SHA1
f8a73c205962012c4fa5b93ccbc77d7b1be3b5d8

SHA256
c70c12b65715e837682baf0eea8ff99a7531d9036b0b5a9d640def85df92d016

SHA512
5e0f64f8d333be4fff5b869952fe18f3189d6af97bfce10aad8acae96153b790108351083f1b80c40d76cebdca35e5d7e0f3371c588a02c74e6ea0055a3d2b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
74KB

MD5
bc9faa8bb6aae687766b2db2e055a494

SHA1
34b2395d1b6908afcd60f92cdd8e7153939191e4

SHA256
4a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed

SHA512
621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
dbab38820ded37d72134f7f6ba521136

SHA1
826bb59ab534decf44360ba75a4c3c67ed4916cc

SHA256
9ecfab2773dc76c18ea4225fec3b8fc5602b9830647e6d0158da1f3dc30f4c28

SHA512
cd087ebd8617d773d9952ac87c8552e924a2b7de385665b365b2801f35719dcc6d3b225073309c9d1114819529cb7392634a407c31e8e3b124cbee94756e5d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
dbc08bea9d309f9db29fc346c1add646

SHA1
a0735704df3406657c790e496958291cab6c9dfc

SHA256
0b90ae5ccf3d1e873a1d8dde7598c3534b2f5fc3aaf3449eb6ba791c0adbdeae

SHA512
d121710d56b95f040ed204891265424d12d75549df4f87126e6ec28492756b7e48d6ef9e6e333597688a85bdf64851acaa3327ca8a5369cf22cca9c82ff3ddf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
3ae0c0aed4366a7341b1d2328fc46b93

SHA1
f767dbd33a18dc74db7c8ad1e76cdbe3b509b284

SHA256
e43ea7c6b7c63c9ba45e4449c0244be464cb88d92b5cd5e75d88aff836a4692a

SHA512
097fa301eef28b0d3c72602565681c09e2f749347ef8e4a82cbd93c9f473c2a770618b0f49899f5a0d6d77d03f524f81dcb94f74ff2d36caa6f932991a5962da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
947fe2283d99a660b6f1bb28fbab34a6

SHA1
40ecec689650069af3f3c530daf3a4ab4752501e

SHA256
7bc5cc62fb5201a1c8037f139c5b5f93140669c051cd3a981268022256a5a07b

SHA512
7ba3d6adecc1d2cd0c648ecbf19815c597b6b3297ac839cedb26dcb465500d5bcb142e03e6d159296e45ecf94f9e6405f7fbb403debcd2e1145021745e1324b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
cc36a2bdb31725412f2a949419005544

SHA1
19c19454cdc416f01d0577633daf499992cb656a

SHA256
cb5f75df322ee17a11778c9ac66a4fed793c91fb313a0dc68e705db073a0501c

SHA512
fb2e27114c2a04eb8b99ac73bc9c59f14ec6c58bd4e229b2308bef2f1842827de70b9f803e60ad38852b5b4f9a6315efdd90a0854448957699b7885147544fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
cd708b2ba767f2b64e628436aa852638

SHA1
a85da05a0cf07019de233995b102ce4f548a9065

SHA256
a5d94d86aca3d2ff7210b8e11f23640a14545f8826068654c57f8060edcc8555

SHA512
93ba58d91b7dfd582a75615b743fcc8a230cdad6895f278eafe5b31a4feb7aa2552a7123e899629daaf8b0c020ca65643e1ae953e26a025e2d167840717fea18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6KB

MD5
744d651e893d3dfbb06731e67df90df7

SHA1
3df1ce2541a460ce2b4345309db35b58b38bcfb0

SHA256
b4be033695828e88cb79ea49cf26f3457ddb534cac64ffcc84585488c27d9b3b

SHA512
7939d358c52187a8d99259888509a871aca9447977cf99c974b7da2a527aa1bddadfb105e8d2e9c0d0da5f7ae613bed8056f35cae4d9763a2a14d1f1178545c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log

Filesize
1KB

MD5
aefe1d7c700ac94ff486cee21caf83bd

SHA1
1bf74e6b65afb94edad8b950f21556daa0c7e7c0

SHA256
9b0c4c882cd1a1ec2890b9f7a2067c25994a735af9cf8613eb520e775b88550c

SHA512
61550839d8bb407300fc3a1a5ba88ee9b48a596d7217fc821949b571f1d6efea519897ad5f497f9b26ae5758f39bc1f8aa0692b81b38570339788eb08488518c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
491B

MD5
c6e529983c20bb294d60352930a2d13d

SHA1
7dec2c33b0322fb37325b9841c35bef116780dfa

SHA256
63618474e08b068378c48ef61267583b7216403e613f640317eaba0230debdfc

SHA512
c09b812ec79f41087251ca909f9259d48cd37a4c6369ce8b8dd7ad55a852d89eccdb981299bacb46725a7196e173b77889d5cb9478c626f295fce4c82985074e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
159B

MD5
d643398556beeafab8d13ed9a48e1d3c

SHA1
b5bb944d10d8b836981a792fc1232530938e4940

SHA256
bd7806b070c24df09063b35a82a278b0e534d41ba2950c0777775b493bf16589

SHA512
6dd155cf6b86becb54437a231a5f1be4e5325732fe5a75c718846d7b522e0b4ba38c401c13dbd9846671335d8d96bb07d076a474ebe41f70af6c20c3f5e2ff05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6ebcf996e6b48615b8e6c0e2d255be07

SHA1
45eddf140ac7ee05e51164cbeb22ff8e16f499e1

SHA256
816ce1de8c4ee02f0d16fab1b802eef000e051c555b47586b1912b8df427a077

SHA512
2bd74d7e5edf3b9546b96537521057c5d45197d41f3a63bd7a4aae6008f1711148c25c8b830a5e006b83a0cd99482071669a46e2b2bfdbf4a19a6f33e14a59a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
252d45dfd9dba544a7ce880f3b4e13db

SHA1
edaa1d24e35667bfa9f1f0b12d030454cd20b017

SHA256
8a03488ff29404c4def8a7112693d0c5c85afef01451e84121488324d36d5fcd

SHA512
3b90e69e469570868673d37567dc972e377247ec62b040dad79bb7fe9d311eafd92fcbaff316ccdb5ba52a352cb39f60cfb9fbb8a457584b40723b4cb741e284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
6ec39090393f8f9ebc493ee96cdb10fe

SHA1
8dccb26fb5ba6c311972a88ff87da2a871e984e3

SHA256
9464094876c153c962ce367238d51d0ad57d1f15e26ca2f95135cc76ef832880

SHA512
948d42fb6fdf1442c815f006b1db9740ce9feab50d2c2443d99601aaca4def609d3aedbea343bd4f18d01a389062317dea88466b92a2edd62460f4138a67bc0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6618e804c9c8817cac36b2ad5dfc4b34

SHA1
fb431dc357a44644ef39ac5c39d5ea19df63ac81

SHA256
23752e85b8dcce9fd61560ea0984655f56c4b09d501f9f4151e4ef2e8078377f

SHA512
567a58ec48586c3f03f62eb1201c5073a316b90276cfb8446b2ed28b5ec7935c816bba1326ce39f92a8f5ecbc90efaadad30e5810eaa3d0c0fa483ba1a92d3cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
066cb1263678bec8c90b72ff5856ace7

SHA1
3509d7f6778806c90738976592128eca62ca63a0

SHA256
e49b741eb4ea55c7709a35ac07f47e8a45167430281d02c857a22acffebd1f42

SHA512
1923927151ad0a3bcebdfe44927b97286cfa46cfb2d5f00226e3530f64179d415e8fcb9c2a35ad10cf79e621b67f548260121363c680ad4b5f784f960683c13a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
be3df60d151f26684e021ac19e6a9bcb

SHA1
ebfd1fbb19312c874580ec0565cadba4e595e6c7

SHA256
976f5bed10fa3bb80f26c764b76b912ce4c7b6b2ccf51011335b05a138a7ff80

SHA512
77f4d16c741c7f50387e68d6eab432382b58aa43fd4bf1c19bd00b894087f2016f759d22074e12cf72733ad6c861a5559b3b6e5316dbaa9b09bea6f596a753c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
829745a919e2c4be33ec577e1ae40809

SHA1
760dfb61435d61e202dfd81c9af55df881ad4d2c

SHA256
186b85a160a75b00369da3767b3ffddc5351da0feb285833b4d60a659543ba5c

SHA512
cbd47b78468dc503e4084d29a1d7fcb259bb5bf3e2906249fe080fefb2c77b0573738a40810a44d87c127aacc1af5d9adf4f00ff21d4e535ea3e6bd66a9477ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
110db9b8ed75d02805794184eb0751c5

SHA1
0cbea8998167170524b7c80727064d2b9681d864

SHA256
a63abd2d9c8293f9f5f0ac427525a9d3c8f3f5eab0cfab290617079f1db6ffbe

SHA512
6d9401179e33d10f704ab20bbe86e6c9cffeaab79e0ab75c80e86e5f388adc13eee1998f143e26623506d38793c2237a9e57708bd7d399418aa386a5828c31e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
42c87423a1b316bab09633e04598ef6c

SHA1
04185452bb8faef24048e83edd03eb89fc437fc7

SHA256
a0ba339fc9a983aba2b39e823a42e2eefbab756a6924c49cfc098ba59048ac66

SHA512
b4c672baf9e5d33990b4cec85692f01d16ed999cbb2772876c2d28880269b64ccda343ebb48911f9209fea54424f7521617797cc2797cee9a6d1cc3d45eb70d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
99ee7577756b48597435e274181c09a6

SHA1
e0a52a0a3aebcc4133d7f3f16eee97636de8f18e

SHA256
704400efd989b59250911c97a0d10b9f3bbc579206b2ec54662f07ae2cc343b4

SHA512
dd7528122f678b3df4bb4b055de5230824e9242daa1679127b9080bb351e57afb1f9f43e7ca2bf90b150f8477dafd7b833f6af48397a3df1afe19bb63a9147fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
219bd0ce268b89ba2621ad7e9468d610

SHA1
6aa49ab81a264317566a63036ef830e10c2990e1

SHA256
d777bed29ec52ac4e313a629094965e4d84352d2722f48b6df54eba1846b9aaf

SHA512
30d64c00dda953a6a7321ddc2e3b0409eb873f3a5510f64f52c4989f1c13fac15939a938348716cdc57d248ebb2d390a5c969c85d8bbf98fb1fdb92459e20ed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
112ea3dc809d5df46ba51fa555220b06

SHA1
4ab16a2dac44425db28ba4c39ef0cc14e0ded622

SHA256
8646e2ecae6340cf7ea3994c012ab6e9335c85adebd9edf95258fa4014cf878c

SHA512
1973bfc3e9fdcb515542593c435580179bc19f0e9ec171a1b0615a87317444506621f4853c60cf28411705ea5c4dcdef0c4d433cd900251f0d85e8c4044e4d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
628871c044d65173b7863ce65f2c6fd6

SHA1
62d84d7ab258b01ccef227e73dfc2453174337b4

SHA256
659df66a286425188268eea448b3d0c5f7574ac77df918bac2aab65d037649b6

SHA512
9f8f0d56a0959cb202409db2ed81fcdbf1907ee5554c1400b3548789625ba4f0439135d7f803261d0f4e2b68015aff57902beb60fa50423bf1cb8bbe0a3b41b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b122fc4589a8b4b8ea066a871bbf26ad

SHA1
b2055aa4bc18f77e48acd61dbe3add65f6a2f11e

SHA256
096275f8ff16a42631127c5ee9195bc165645084d09d9cdbd00dba1036cbc48b

SHA512
20e499b38582769a4be4920d393a59e73b1adfc730fe0702cc7be34aa3dcde013d055824be6349c7de2a929623fed7c2dacfbc559500d3df33a0277b29a25fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
141f0e382dc3de17949896379433ca3d

SHA1
c568a54dcff01eeba664d71de188b219b7ca1139

SHA256
8d1633946fcc3cb7814ee4729f4374c7e0ad97c40f5cc1620f8db176ac825844

SHA512
4aa119726dc5a5beeff09b46ea4ce507df0a9b5d2e05a120c904faf391db0845cb5003a9f2d6f6e0e7a0720405b60f770c1c030c6f8a1ce8f9e906ffe02051b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbd0768804c8873e2dac06fc021dfac4

SHA1
238a48c8bef86ca3310f5de138a34403618f5f3c

SHA256
c08c03f79a32e3c82b9ecde15e421b0c6267a194176a5ecccff1ebfa07d8e463

SHA512
39d2cf7cefce075e32ec9863e8ee4d4a4df4e76ef6e3709f276e467e2c453a641a704f933c4fb81c126f2360bed0e9555b7517aee5dfda656b375d0185019f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
049fd1d4e961e7646a7fda2027987844

SHA1
3d5344ac832db68145cfffc4f0a54f0358551d55

SHA256
f2fbe12baa3271a2e29584171a2b74321745deb39046da8c373c3b7f1ab2e212

SHA512
369ceeeddb5e49fb1f674df0cd5b42c9dd9a1010e23a555cff4c64912a4c6e126033adbd870f132423d7bb307bdaaa67eb3ae1145c811d00232b48554cfa2d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dfd2f08fd41b54991941bfe3299ea65e

SHA1
34c0963fc37abb2aac6a0f983f58c63c1a4b1102

SHA256
5d7053f251b2115fafa0c0c496d8464e51b7e08dfc4b3e45de00b8df87fce376

SHA512
7107753eab257b6d4f9c38eea803aeadbeecf1348d5ef601f0ad1f957d1dddb90ec5f65e20df71ebb0b28032962ad19d8c657e29f5bfeaa9bf59693cf817ebc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
cc1d2a482b87e664da9d92ae9f355dbc

SHA1
6e77605366c949e2b368ceeb917707b2984dd80a

SHA256
6835d4e0d5edbecabd8b25999b557427707441de7c21e64bdeb0a4ab0dfd72ee

SHA512
3b140590a68a43b85a4ad687a79e6827fc7b170788a62c6e91be9322a5b37f84cbeda96f3733f2a458de968730de2ce49e0189392336f6ee20e260aa6ef776e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a9325fca2d362ef10699f45f84cd5e77

SHA1
06f798cb69781899490336d99d22842266f55d5f

SHA256
48f764573395ca5f0c054f3c0d4373f39918771acaf0b875204ef6ebe90b6044

SHA512
ddc2be221645bb8cbfeb88f58eb26f313f9e6eadebe5ee803e63c2dfaf0075359145f78a4c88a152ef42720d10eb1484a77b1e38213d40b557aeb0af9359776e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fda7ac3f48b9bc9b89939950ca84d882

SHA1
541a8236ca998e4aeff259da034ee9fa5ca4f676

SHA256
12c8da54464eb8146f6396cbebdd76f543b9cf7c4d3617124ad8b27b2e380253

SHA512
69672b023b88cb2b9f125711668e26a47e602e81020ca92401f624eb3804feebfda41e455a7747770de4fa36070071beaaf37e65075136eaa2831a16b3b7a726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6cbc59c2-52e6-4d92-b68a-62d5151cc928\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\783c33d4-f6a2-458c-b71f-5b944935311c\index-dir\the-real-index

Filesize
2KB

MD5
cb1008a19417e36c1a19900261f2fb5d

SHA1
86fb8462d7bed4bee78b3b206d479e9bfafa4a6b

SHA256
2e2487f29e745d53495558dd5101a252abb792fb188e5e70cf0ea118509500f2

SHA512
837433540c00cef4074c2452d36df5394f1fba7b9828eded92eebe8e9e38b53eea84b558e5710fd533cade64fb61a7104fe9b9c634d70eba42dbe45e25840770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\783c33d4-f6a2-458c-b71f-5b944935311c\index-dir\the-real-index~RFe5786f3.TMP

Filesize
48B

MD5
b032c01427843d2705db2a322094f551

SHA1
021830370b40dabfef2ebb73e62aaae446cb53b7

SHA256
e0435a5aca4ac614886228f5a6af178f5453afcf1bb81d16066e7438699f1992

SHA512
1b817d38ade11cd4d740f2ac557beda2263345aa98833b20f86d5f609f681d80f86cd5145eb901336ff6c1e94fa0e8fef23ea1f4002cdaa03194f7d4230e2bcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c8016d37-9572-42da-90c0-9873df4135c6\index-dir\the-real-index

Filesize
624B

MD5
f8a9d2688bb2a31b44d4b978a7665469

SHA1
0f60d45b19fcfffdefa3e2a53749802f47b240a4

SHA256
08f60e98af5d760284f4012478620b0b32c038ec1f19234ab6bb465cd70ba04b

SHA512
d4a94671d547d347aa59f1e9847cbc4b80d3a4f2fd16f217089b5c2fa1450085626e565f5073de677ad58541f1be0a4af5e34101dc148b7e1bf136224e690315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c8016d37-9572-42da-90c0-9873df4135c6\index-dir\the-real-index~RFe5c166e.TMP

Filesize
48B

MD5
86629b735727d99a00e2a2773b89ebbf

SHA1
ba642cd7d42873cded22865a35d266f2a682eafa

SHA256
fd7c4c6f745df0bab00d1df05689b9994cbf6003adc6f55fe19db12f781920e9

SHA512
6317de00ae6a792166028517e07edb9bb6d80cab91ef6fc947cfc64733b774fd696d9fb54b0522b80909e9b3e9f095ca0f41f4985d2263d2b75eaf855901a212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
1be8c6fe7a26b1c67b6bd5a6a9667a60

SHA1
6260451bf64f2997afc5e002adcee88ab5daebd6

SHA256
ae360e2bd53f6027536527e71a330c7c6b3dcc8b93dda9c50a0b9bd8fd50bd95

SHA512
99f158a69c6d5a4ef35559ae53aaca79a44caa9628c251e9361439264e119c547ea0074a036878e8b13bbed98866d452e05c0660b2444f545e40fd1d5f8cccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
8354bfbfaaae247902cb4e7a71ebc867

SHA1
347a64a1a93320b8f11430c9b2f4fa44c455b998

SHA256
971b42053d7b92f6256a3a19b8d164552da69c2d82b6c556d1603b1cff32dc8f

SHA512
1e373e3bbc26a0ee0cb5e86693874757566754e448aa5188a225242fac23be586e0d252cac9a5bbd1ad98063ba420ec8f20b8a8b5b6bd606f4f6a1a11a69227e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
8bcf78fde639685d761d5e049d0c72a6

SHA1
c1ff49aa54ddcf99e3044b4f18c383c0fae63e21

SHA256
014dc32593674c22d542901134c2ca4420ad71558cac646aac8921de1a9b5b3f

SHA512
2635ce14454fa12e11d169f7b1d72674d501cecb2f22cf72101b3cc80fc5f6384e6df2272c0ac07b07a418301d31a80705f2e68a2024f8a2a3e576d482ae523f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
9d9f917b88b9ba449e365992cf7c01b5

SHA1
4473913d6b2e6d548bbc59908d0d0f11090773e5

SHA256
564c3951ef4f3bebd45072c550d575b79bffad698975562bdebe0b406a4c3793

SHA512
6004bd6b4dcffc7d5f6603a158839debaecb2cf0a8bfa0eb05ecf9cc5dbbdabf2b7691fd4c0509b8b02e32172233f7e08c2e8b0da07f10e31b6f94e6294c47ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
5f5232793771c3aca39a971452abd705

SHA1
4bae83f312ddda5207fec7099fc71097b15ebec0

SHA256
8ca17dcd0cd3bcd6826e8b9e86e40f11951e21e1b45c6cb9e213d3deccf0e995

SHA512
f694b821d9686e335557d280f57a11760fce3ba9bb0422bc026352570578a3885fa88b0ddbac992a692a767b8eeace7e8288af10063f9f413f21d3b60cd7f917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
d8ff659c8600eac14b3f27e433d85452

SHA1
5c66d31e08eb369ccc02b4ba47d7effd0d1212af

SHA256
52b89e49302894c36462e4c05b45150cad2bfaa84c0edf57bda72dd55ff8c37a

SHA512
36a17b0d3c868d5ac1db4d644d427918e7deed2b2d19a6515c377298690a3668f245de9def2ad04aa3748b61476dc092317dcae0ee5a2f9bdad309b0951c1fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
2ae29ea6b244372e362e96528971e9bc

SHA1
aa705d6c8e2561aaf3eb07b2fa6448aa14aec4e5

SHA256
16460d555080fac499f682f915104edb60abd2b0fc000729c04fba23c9c00aee

SHA512
8e5ebf1c1bbda13ea8726d460b8ce4a4ce9aaa6984509a8919214b235570df28eb22874f57a06345c2267ad7204ae0a16ec5e046c440b9a62f52cda909704879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
c03dc0beeb2d73d433acbef612b132cd

SHA1
0beb067267537530485b215be079fcc973140792

SHA256
5551fcceca219c8ecef832800d37966240a8323eeab8bc32dfc7e910d433765a

SHA512
0bc37fa3d39ce5cb036fd956d1d8e0bf3acba5b24284db56fc6d53e7d69c4fac5e2480ff133cec4fbff661b79cd39fb9d972bea1cbd6c06c9675b426fecaa6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
143219642393998c0ab9135c7381bf92

SHA1
7903701a0fd02ef1691da2f9c8963c44aa0aa5e8

SHA256
03cd22f2580fbfff0ccbe325ed42f60bed42403e5bc01d49095954d7407fc5a5

SHA512
b9a80c8f3e88c09782eb1e0eda5f79af76ea6649579ad9eca2c31f186724d195bc4e82a3684647d21b80986f09bb2399e107ddfdb3add005bcb3b4deb7e8dd56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
a3d75e69d77a77d1516244c96ae72085

SHA1
4b71ffc8d9acf24fdf2cd8c2ae269106015cccf6

SHA256
c35f972fdbb567720565ce6db6c0f53cd526abe75c9f82dcc2057c247e6a2c2a

SHA512
d853567280f448d83cbf4ae7f4731519d4dc0407e28ba16ea72e411c3e2882446e23d26bd7369b54f556d3544d8597b3fdbf556beb7ad7c53d45748cf95585c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d503.TMP

Filesize
48B

MD5
c089906fbec3a2d455e2c50159e3b120

SHA1
758c13b3c8fd15eeae75eddac83c027d062a15bc

SHA256
a3fd3fad3c81993435ce7cdaa93c5e7ced9cb8ec8ce124d880f69a33afa9d41e

SHA512
03659a02e3f71b135a2bce4988a77916b28bb97412e8bc60bd64f57e1f1d34469dd510ccb958ba34d4820f21616816fedb49db2a2b8f442f6069199b95f0fdc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13360355918394357

Filesize
37KB

MD5
c141b5ab605a1d35fcb145069b06b2eb

SHA1
e2f683b98a0de08e1b236caa4ca519cecb9dc082

SHA256
2dcec23facefd90ba778d86eae95557dd34bae0c5d32c4d3ff06e21dc8e986fb

SHA512
2621f1b820f4cf26e1c02e38f58c103974cbb843a25d4f98da844ba4835461af861db04e3f73d26e49c5f42f19a47c18f34d9c80adf95ee35108dbc0772cfcd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
400B

MD5
9675ae2906f625407a0e5640eb5bed2f

SHA1
27efab030072b38e42b524bcda495be9b77de675

SHA256
9c74745199d1f6d1f43b80e3d778ec1190ebdcc77bbfeacba35bf90129169168

SHA512
de388b87e20fb1dcec393d4b763e5a19269863f832f064de111a76833f604aa45e848c530058aa9ba0a69b123c310799b887ef3b6e47d5c58459e3e0b903c0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
1cc1c718add2b236cfc3a12faf351b47

SHA1
08ece68c50df517e348d3de75715550c4d8921b9

SHA256
1e22f71bc0f4568e5b26b2621f5404746b8e6151dc6417dd2e4bf2da6004162f

SHA512
ff319506883fcf27b0195487c62b960e753715e2e04936ee4ec771ef54c32b2c27b29a9228ddf784b4ed6b208603ff4c079188f17e98401d29dbf99c9c451c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
0b9521c43a8851128d2553e196cdd6c3

SHA1
7554be928e8c6f70004f2f12d601df5ddb2e8c35

SHA256
8f68deedd25968675f3eae1ab029a3ba9e048e2576c96f5184fc54894eb86eab

SHA512
1187d2bcd96cd634498a947f693863e7c96f04568312630f56438368cb7285a8ba3b392563b38f562b6f9b7f2cf627e1504fd9ed0d5346ef2829fc0679dc7fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7299c1c33d8ac05b0391f4385e6eeed2

SHA1
f5dcfea411e269158c03dde5f5ca63e08c1e0b56

SHA256
3cfc11692bcb546fbf668f52187ac7915c39c7a7397cf17f35785f74df5289a8

SHA512
c0fa85e736818034e90ee4dede71a1ecd238111fae3ca5f5d76c044c5ac9a1de957d6b6b7571c64f173b864cb9b38da5527d83c1cd80cc1d3da8c2bf23059eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f5a0cfbeb25ef9d4710e7f63b84ef332

SHA1
3a7ad18a3c2c95bf8a8a99c4f898227bca781ab4

SHA256
0855fd8abcf33f337fc465ed7755f15bde9fe47d38ed7a08e15404e7698e5a8c

SHA512
0f2eaaee1be285259d6c5ccb6e6f253fba285af70da310503077a5e850d4b681310b3a005132883621813fa1b5cfba70752b4b6409fcae769e83c1652af7b91a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a027ae694a283b7c732c8a6a9e66db22

SHA1
2fe81e5728f5a911118aee09d7b8f9e9c776cc77

SHA256
8eb4036c55b3d8c2b2c373c7357e4c969f4c54bf9409e25ffcf6ec9061b387a0

SHA512
b9655b7c737779629bd59cdf77cef71f0439ad86f61bd821d5608a7c7e04b4ccef988dbcdf52b78dabfa2bd7ab0823c2647b77e8ba019201f9b58cd1a89dcee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
56bc5f6f8968aa0e56f071aeb36672aa

SHA1
8aa65ee4a9eea36ceded4952600eb6815dbfd0a0

SHA256
59bdaa7bfa380d8ec538bdd25f2ef97f029beb5051e1e10c2b8697a273e92f05

SHA512
d11558fb5017085148dba4832ce464f9383095474b527532bdafec3f2daa8721957c2421b54f2ba2de8f47da4de2c22608ce4a6ed28179d80cd2db2e40b359f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
17573773f7bd634a0719df5a15e5ca3f

SHA1
b8bfcdb2b4d6ece2f6142a153dff02659f10536a

SHA256
bda317a3e13ced30da1e359fee5af225d6b9d5744cd9984fb0208620acc06ced

SHA512
1c569888764b1fe3f9023ffb72d07f4b290c2dbdba829caf88ddb0771a56009ed6dfd6603c44172d149926e27b0f19f5eb88c90b63e8274e714798e5cf426a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0465794351ce189a871f00d58f2ea871

SHA1
580b79e28f69f8f359f11e00f0c5a3437ed9cccf

SHA256
1320fc5a480a6f6c27fcc6e45c5e75bb0a5ff6fd78601b8258bef73ba7c3f029

SHA512
95b85b7d372f922f425b559e4f7684f9b66966d081845d894680bc39654aa007ca4a119b31548c0d9a6773832acaca6f65191bac2b7408cbe2c1d21276010e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e3668bf89a65734746ccef393e7283a

SHA1
32ebd754732bab85e961b77b2a1940342b7ca4ed

SHA256
dfe16e9c5c69ea785176901db7f8ec18b9fb31b51440fe8a60b7cfaf34a04d2d

SHA512
501eafbe6be13a19caddbcdabbaf613484600e71b9d44f53d769ce916e90b9be3ca0c3171e136aec1d50b12959812e166b8613ffd04b5ea66e367e7eae1bfcd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0cdad3f2c9114a05925556f1d997e0c4

SHA1
1bae86d82ab9cb6d28746d69a4f030dc1e66aeb3

SHA256
84bf1dc22c33d9b9b6f432f7962509aa2890a5dfdb8fb0c204a5a7049b6f47e2

SHA512
8213c5af253bc2863a9e5bbe3d3f2c6d2bcc0cb0c27cd0e9be49a19bae7b87f323afac9e865cd8bd9f03281d946e848c70acb7d80cb5d70740e5f36c306e90f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c505.TMP

Filesize
539B

MD5
c2637936055f0226bf5dc5f0e70d809b

SHA1
ea6c2e76492666f4436639b141d350853e04824c

SHA256
0251de75e685fa574cdf8d32d569b5e2ecd0b67b6fac07a03a4a3a342c2550cb

SHA512
4e4de0695001d9dea79fe17db60dad095cae1eaf3a58127be6cd5c15cb8fdfac26f546b7809b4812c341c2980542f5b0612f6204797837675988304334b253bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
90fff293e48e23892940fec0283ef472

SHA1
e9db48c97cf24fc5fda1ed241f01e399640c9c3e

SHA256
ee60ec4fff04de37129bfeb5b5b7fa8d35d5081dac2221771c5ab6221bf9675e

SHA512
d7f06d9d4e48b3feb922f5d63c3bce3e382d392a6d0b7a606d88edba9e022a2d961cb8686b4e2978cb7598062191e3e83f0d2511bda51b747b95eb211057e0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
b559437847e53a608e29e39dca458cf4

SHA1
1ceca2a465d24b69efaf0e7e75666e3b431be11f

SHA256
cc7f379209bdc5e205befc42391a9e2dc1bd656c46e235815136a981d3231c0c

SHA512
b226005c99d11a9f18ef0313867569a31312530a7aeb0bed5fc3fd17a3ff7eb6af1bca2324ed2605db77a1d0ad48a4ebf22d049cc87df72f36095f33aec44501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50152490f9861a5cb51e0069b91018f5

SHA1
81ccf42c6af030f38000ffb275d178b13e6524b1

SHA256
b20478c47331e03cc2335077f8c361baecacbd8a92985e398c39879a4c9af7ad

SHA512
71981b1bf8c0047d9e19afa3bb1635d2962f330bc1463af0511beb05aed12fc84226fc94501013928f7305e151451d0ba8cc467f5ff3b074395ca73f2fa0742f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
21d43a2694653319217dbc67e17203c1

SHA1
e1a09b581de08ca0f72ec11208fe7e8cc1588775

SHA256
e06bb6a1479494af47e1f1f59237ea6e63fc9cf953389555f2089a75732e0de2

SHA512
8afd604379f54c3d6a09f66ba2f7f50d1812701334dc5d9128131c1412185ec457bf77fd155578db260c6836ae4ab9d42a954ea84b03696753eb57a00e3f111a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
e4c83f444019817492e8cbe0e0994da4

SHA1
c3d98b2961134217666759d52c7f4e4e9141e0ce

SHA256
7b72b75cf0f0dde29e8c51a8d581503cb49f0327c2ea04bb7b178f3d5a7e1de7

SHA512
0513dd6c4df715d50a2f2601047823941de015c5fdf55359f2639b383d2d897af6b5e340257c3fc5d8fa991c8b057ad18dec393d368d26501f5e11a389d8ad44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
2cc59e3d6ea1a8046a8826bc9bc3913e

SHA1
a380bd48e31daef4871f8a949c40ee91b4e512d0

SHA256
6af70568316684f8be27001b279d5dacb18d3df187d765d168a4030405148221

SHA512
96d5d7e4f50d06012a2941617c56706d3a56c2d4e285307e56016c7b5feeb06d0990177216ca47a6c2d5008bc235cb37cf4d615c84ae3b05d4238cf67fac720a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
35875b11bdb7b713df109d3ef00cdb97

SHA1
68bbe00e31bb83f2f14dbd1e83f547bbaea7809d

SHA256
6955ba9c94d3f95802a15006603ed2337d32473f4f75f66aead0044edb470a36

SHA512
c45c929afb8298e439fad1a9200b225e734c0395bcf2dafeafd0535ddaf6ef7fc6f88560f93d1631778f27ccbb312f37b361accbece0aa06bdb346dab9013290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
064ed99a8bb9e2ef89df3570f429e9f3

SHA1
fd53efec01c3cf5eb3a22c9832cd319aef136656

SHA256
a914eabafa9a5095803b0b978720f0e792724959cf5868ba24af16fe681b88ff

SHA512
6978551bbcb89e422d46f15a665855621e4da5730a3b81c1e1a336db361924b48fa0cd698625fed73847b55709ac383d5c5e3d020aca213ae56272c5d7a532df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
e61c51735a4e9d588d0ad8146bc5611e

SHA1
7c0070007fc31add7a8a46f197b8787926b4df4a

SHA256
a13c551c0767ec4d9d108568fd805166d796c2f979cae6d68bd2e913be98cf9b

SHA512
0a3e29ab52f7573474bf1cc2b14728bea8cfa2fc281f20ddd4cbb228bac649f986e58d633b0f2e0255c9070766ad7a65e7a5a69d069ca95e6476350207725503

Download Submit