Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 08:52

General

  • Target

    http://img.sci-hub.shop

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://img.sci-hub.shop
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffb014846f8,0x7ffb01484708,0x7ffb01484718
      2⤵
        PID:1156
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:1684
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3568
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
          2⤵
            PID:4756
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:5064
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:820
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
                2⤵
                  PID:1612
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                  2⤵
                    PID:4900
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                    2⤵
                      PID:2244
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                      2⤵
                        PID:2704
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                        2⤵
                          PID:3680
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
                          2⤵
                            PID:444
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:400
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                            2⤵
                              PID:904
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
                              2⤵
                                PID:5332
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
                                2⤵
                                  PID:5344
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                                  2⤵
                                    PID:5508
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                                    2⤵
                                      PID:5516
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                                      2⤵
                                        PID:5676
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
                                        2⤵
                                          PID:5684
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
                                          2⤵
                                            PID:5852
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
                                            2⤵
                                              PID:6088
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
                                              2⤵
                                                PID:6140
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
                                                2⤵
                                                  PID:4604
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                                  2⤵
                                                    PID:5220
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
                                                    2⤵
                                                      PID:852
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
                                                      2⤵
                                                        PID:544
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
                                                        2⤵
                                                          PID:5296
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
                                                          2⤵
                                                            PID:5420
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
                                                            2⤵
                                                              PID:5436
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
                                                              2⤵
                                                                PID:5256
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
                                                                2⤵
                                                                  PID:5588
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
                                                                  2⤵
                                                                    PID:6100
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
                                                                    2⤵
                                                                      PID:3068
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
                                                                      2⤵
                                                                        PID:644
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
                                                                        2⤵
                                                                          PID:5148
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:1
                                                                          2⤵
                                                                            PID:3864
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
                                                                            2⤵
                                                                              PID:3192
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                                                                              2⤵
                                                                                PID:3372
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
                                                                                2⤵
                                                                                  PID:5320
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5236
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5296
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4648
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
                                                                                        2⤵
                                                                                          PID:1144
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
                                                                                          2⤵
                                                                                            PID:840
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5508
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5528
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:1080
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:3612
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7428 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:3048
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:2024
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:3784
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:5292
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5560
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5764
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1495490569327183742,8832549068723209677,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2944 /prefetch:2
                                                                                                                2⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5192
                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:3428
                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:1200
                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x2cc 0x494
                                                                                                                  1⤵
                                                                                                                    PID:4704

                                                                                                                  Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                          Filesize

                                                                                                                          152B

                                                                                                                          MD5

                                                                                                                          537815e7cc5c694912ac0308147852e4

                                                                                                                          SHA1

                                                                                                                          2ccdd9d9dc637db5462fe8119c0df261146c363c

                                                                                                                          SHA256

                                                                                                                          b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

                                                                                                                          SHA512

                                                                                                                          63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                          Filesize

                                                                                                                          152B

                                                                                                                          MD5

                                                                                                                          8b167567021ccb1a9fdf073fa9112ef0

                                                                                                                          SHA1

                                                                                                                          3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

                                                                                                                          SHA256

                                                                                                                          26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

                                                                                                                          SHA512

                                                                                                                          726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                                                          Filesize

                                                                                                                          50KB

                                                                                                                          MD5

                                                                                                                          469c6654c338a892eed8c281369afe69

                                                                                                                          SHA1

                                                                                                                          3839890df2b341a8ff6e52561040c89df555b4e7

                                                                                                                          SHA256

                                                                                                                          5ebd0b914484f23d866c0edcd9f2ce0aaac9b7647e4457020bd8113cce257edf

                                                                                                                          SHA512

                                                                                                                          abfcb4149612fd65e3c8c3efa1bd1853e57072cc2e2db8889f43e309b9d9aca3e67a06aacf2d7570e269fb6a76d72b9cb77c9c9da3f75526865b9ec83abc1061

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                                                                                          Filesize

                                                                                                                          143KB

                                                                                                                          MD5

                                                                                                                          bfdc9feb3bd5b1a9e7a6b9be9d80a004

                                                                                                                          SHA1

                                                                                                                          078f4a4ccad0936fec2a490f57480958e0b755ac

                                                                                                                          SHA256

                                                                                                                          5df4785acad19718588ae6bc4e94a4c8b804b812f5406bf391a19ccb77ec73d9

                                                                                                                          SHA512

                                                                                                                          688b183df94c0e4663355e6cd149b7542df238435a40e93177c3d9c5ad6e9573ff4e173f897c22c9dde248b9bede99012bbd1a48ddc3eccfc8f15725904cf5df

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                                                                          Filesize

                                                                                                                          19KB

                                                                                                                          MD5

                                                                                                                          69ef77257c7fa3a494a232f90b05d55c

                                                                                                                          SHA1

                                                                                                                          19dc83dc05f718e9693de231d48bf0307d8d29a2

                                                                                                                          SHA256

                                                                                                                          d1ec04bcd468208a30012d660d1e857bd9d4d937957d45bb10cc7483de435421

                                                                                                                          SHA512

                                                                                                                          1b95ee10d622e1468e04691dc47fcb59da6349ba8cdc0814ac8d27a0ebcb9c09692ef1b86533ebd59f2bca87f3340cbe032a011223afe4e7db018af47bab38ea

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                                                                                                          Filesize

                                                                                                                          19KB

                                                                                                                          MD5

                                                                                                                          d546a874d6488dc7b2abd0843b4d02b2

                                                                                                                          SHA1

                                                                                                                          abc38412c078bb9ab9ff9757aeefa67a19ff2501

                                                                                                                          SHA256

                                                                                                                          c243c2a98c75631185c8d04ecfffc2765b0d3e3516c3ee7e2cd8d2b67660cf5e

                                                                                                                          SHA512

                                                                                                                          13c7bde4df056340a345dbf1473a01308fd2786be7a384411814afa8f005d34d2ea979a24cb2d7821b5bd928841ffc3c00944500a55c2f0934155ba786ae9c0b

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          MD5

                                                                                                                          acf06ad2dca5bc3de78858c2baddd710

                                                                                                                          SHA1

                                                                                                                          e3ecca58c0aa4ff8964d1c354a43cae4c3ac6ffa

                                                                                                                          SHA256

                                                                                                                          0b4e287e2f2fc5102dfe5111aff3bc8972f933f6de833ae1339c591095fd030d

                                                                                                                          SHA512

                                                                                                                          fa14ef629e4ec9333c1a061ba03fe79edc9c6c7a9cf3d5bfadf09a893e5ccb4bbb75f2ccb18de919a5e9851024d3e789da6b4a6be422b6b517bfa1624adcac28

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f988877b4bab9df_0

                                                                                                                          Filesize

                                                                                                                          53KB

                                                                                                                          MD5

                                                                                                                          0514ebd9743c4b7bffa8d4b8263ebb00

                                                                                                                          SHA1

                                                                                                                          edd8fa4c8d9b27a15ae00cddf99b87164ee9a58e

                                                                                                                          SHA256

                                                                                                                          1ae9b5c7de429509d95a4017f7ad4ad6a7ebe5ce749ff59362073ca3e1e86d62

                                                                                                                          SHA512

                                                                                                                          6af54929ce570b9f2587f73e017310362ad7d704a05acfd6cd33e040e7ab421a77b3b7282098b33d36507009b5fb56b9352f11b233803d65782912fa62943e65

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                          Filesize

                                                                                                                          936B

                                                                                                                          MD5

                                                                                                                          38e3c6e691803f12ca569123145a1e8f

                                                                                                                          SHA1

                                                                                                                          4901bb6a76d8899af9aae22a8befb896d6b6115a

                                                                                                                          SHA256

                                                                                                                          8a1eef776d3e043bec766868084195a607c7a517f3ec3de672c103d25d580015

                                                                                                                          SHA512

                                                                                                                          be817c37122e37a3c78f565b1ec36dea2154a8b82a0890cbccd5c2b0c9398715e25456529d35f5f98fcf965376925453c54410dd52d73c68dfe51c9afcaba800

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                          Filesize

                                                                                                                          456B

                                                                                                                          MD5

                                                                                                                          323954b068e6b7f4e08eb97f360cc5c7

                                                                                                                          SHA1

                                                                                                                          7554affd5b843200375ea782f0400011f0f42536

                                                                                                                          SHA256

                                                                                                                          c4be5e326ca9d6422bc3a682049fbec3952649cae39e7c54f0a4a724b0964ff0

                                                                                                                          SHA512

                                                                                                                          042b769c36e85a0550a33494050b608c9f280d1056ef537dc0150c8116b1dba42765e18de61173fcddd69feb366370b47395261c9c2a3b1d218885599ace559d

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                          Filesize

                                                                                                                          696B

                                                                                                                          MD5

                                                                                                                          a5d1042b050224a60b46dcd94ce4a241

                                                                                                                          SHA1

                                                                                                                          bb49d404d8f663a7e4e5b846537a85fdb3c40d0d

                                                                                                                          SHA256

                                                                                                                          27cc24dc8084f2bbf50e9498d885e06f495751352de1630eaaf81d591089534a

                                                                                                                          SHA512

                                                                                                                          621616025b8a419dcfb75bc2405d3d0914dda3193f089ffba119b55d69d5f1c5e261e8c5d5c3844bbf7ca68be0292544bcecd8ed4c66c9c9c854c5cdee545750

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          d85ac514fc5e749d4940287a1a05efe6

                                                                                                                          SHA1

                                                                                                                          197e369670c64e9679d59d596675e87cb5f6c1ca

                                                                                                                          SHA256

                                                                                                                          16fd9f8a29ed86c38587ea52458f44c68ccb8052cdc5564bf924931960e7d3ef

                                                                                                                          SHA512

                                                                                                                          b844383f1b316be11bdd43b3ec179a019efd532874a20995c5aca61efd356e45cfeb07833fe5be9804d9ae89ef2702aefc779246ecb9c23d81921515d1554899

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          f6d61c3accd28e6af50353decef3e684

                                                                                                                          SHA1

                                                                                                                          0d8cb56213eea375cb88e314296995e55495af70

                                                                                                                          SHA256

                                                                                                                          c587d6e3e32663f7866671ed35f085400350ccbc1a63327898a40fb712886e23

                                                                                                                          SHA512

                                                                                                                          e1122af60b6e113c461e9f74595371ae6c674ffaf9b6e7735061d42edb0fc189f2778d82287f51d153d7693abd0354cca7b16b30d25f4671d594cb80df7442a4

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          9KB

                                                                                                                          MD5

                                                                                                                          9306668b06541b93b60c2ea66ed664f4

                                                                                                                          SHA1

                                                                                                                          9ec5f7d248722ea07170d7176cc0c2f58f806d8c

                                                                                                                          SHA256

                                                                                                                          53f6daa8c6574cb9b235675ee3a126a87af6091827992f611e708bbb5d09afe4

                                                                                                                          SHA512

                                                                                                                          456f350d31ffbf36a25d68e922a392e67bebd94e3180758e9b377ea1de85238d178f01363c96132c85e5ce2a402938fedb1a78dcb564410b78d561427b4e1d88

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          5KB

                                                                                                                          MD5

                                                                                                                          540af141e621d21587b52e5356c4236d

                                                                                                                          SHA1

                                                                                                                          643d7cfbf205ae6f1b7e81099331de09cbbe1145

                                                                                                                          SHA256

                                                                                                                          88338d10964be0af10fed1611f871012cc5e34e1b7563c521ba4231146037ee5

                                                                                                                          SHA512

                                                                                                                          e39108df1219ddae547851f404869598e1c0f6ff996d1a9814f42c3f370af42d02044c9f434985bf996fc23ca6d4ffe6bead786ca295e9e90984b4ed336ca61e

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          7KB

                                                                                                                          MD5

                                                                                                                          f897b1a8faf9090e7bcdb60071a3132e

                                                                                                                          SHA1

                                                                                                                          81666c59c7223c645f96a2438423a2b655b70076

                                                                                                                          SHA256

                                                                                                                          d3daa3b68b0f795b893ce553a2e6e91444eab13aa7c30203de29a3bf81287954

                                                                                                                          SHA512

                                                                                                                          d3b9b74de8e1b0d3a6b61e8b1690bd51448c409cdf489654effe5b807521b0cb060075374e9b1312e67dee4b3aa00c1ae426d3c6852fb1643e2604ac7a183510

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          7KB

                                                                                                                          MD5

                                                                                                                          4a5f76bd43ef0ad05ef7cf548a13675c

                                                                                                                          SHA1

                                                                                                                          ad7db0dc1c1399cdcacfac227a650e4e401343b1

                                                                                                                          SHA256

                                                                                                                          b11ba81085c1c7ed70791ee3dde6c66557c8951aaf38438ebd5cb0e6a7d40d67

                                                                                                                          SHA512

                                                                                                                          6e3b290525861142f4afc0654a039e417f885ae82f5bc94bdf9fd8d611986848eb9ee6e56546e37515bfbb02f1ebe47c8ffb9073e23c2aae31884416f7cfc4da

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          9KB

                                                                                                                          MD5

                                                                                                                          ef6ffbde716ec81368a9b66e4bc3c084

                                                                                                                          SHA1

                                                                                                                          cd40632a2fb7877ec20421fc467063251b313e03

                                                                                                                          SHA256

                                                                                                                          14dbe3efc05d4b566ac9c1fcce1c5987e7f40cba5a0f7fb7ea059a05981d744f

                                                                                                                          SHA512

                                                                                                                          931736f144bea252643812ba4d37a8b941debff098cf5e989e326a1f2bb48fac46f9353a25a9493e299c731822427efc269e8d0919f30e1be151b04225882134

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          9KB

                                                                                                                          MD5

                                                                                                                          5c182a71a45a20942bf20e9f8bef3463

                                                                                                                          SHA1

                                                                                                                          dd6136708f0be484df93b4a6e78dd07ee45117f7

                                                                                                                          SHA256

                                                                                                                          ea6a27539cf45d4acd574acba2ab11c86d34a0476689db45a85f0178fa692848

                                                                                                                          SHA512

                                                                                                                          ebac0a9899cb6b3864b82964a7247bd7b3bbf0bea1793d332fc5203522344534cf401ed1bec49b550c6dc8fdaa9e17bc703b89b0888632d0d2c7539b59e4c9da

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          372B

                                                                                                                          MD5

                                                                                                                          12102ce8c2de9ae59ed5ea3fde033b9e

                                                                                                                          SHA1

                                                                                                                          719a9d78f9318369fffdf2e84728aa504c306a07

                                                                                                                          SHA256

                                                                                                                          a1d58ed6232554a73db73bbda304e95d75a69d7f6f9522c117e69d3e17a62d4b

                                                                                                                          SHA512

                                                                                                                          e1c1b96363a084441c7a703aee80a172ee4914a3d3a8e801be79e34e601df85bebbf20eec6210b1cf4190edb06736e86627eee587104a30f81f11c9c07bb8637

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f519.TMP

                                                                                                                          Filesize

                                                                                                                          372B

                                                                                                                          MD5

                                                                                                                          caa4cefbbffb973613d8b64e293d0382

                                                                                                                          SHA1

                                                                                                                          fb6c4079b5daa10a612c1bf83109c102ccfc869a

                                                                                                                          SHA256

                                                                                                                          02415aacde11d499edbf6e728e0021ae0f87402126ef76adc489806fa7215164

                                                                                                                          SHA512

                                                                                                                          a5b786886e2cb82c7b4433e3b6d94f20294246af56a38b4daf0517aaf1d60458d6209858219ea88469a6f0935156008b08fb2a1da1f9076ac49551e24353557b

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                          Filesize

                                                                                                                          16B

                                                                                                                          MD5

                                                                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                                                                          SHA1

                                                                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                          SHA256

                                                                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                          SHA512

                                                                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                          Filesize

                                                                                                                          10KB

                                                                                                                          MD5

                                                                                                                          6f6b32ee539d052c0941d4adb17c69cc

                                                                                                                          SHA1

                                                                                                                          633957589c54ed1332e794ff537481a49370f3a2

                                                                                                                          SHA256

                                                                                                                          ffc2afc2a846e68691a91e51ec9fca2c1c05ebc791d1286d6be2d29d65e83ffc

                                                                                                                          SHA512

                                                                                                                          0563da9854a394a4ed75b72c0792df726017f110eeee1ea710b1359743c892f75ac21b7665fb4932ac91a191cb6fd0cc846542627b19e2738cc825bfe12d0393

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                          Filesize

                                                                                                                          11KB

                                                                                                                          MD5

                                                                                                                          f0090b3a1dc8171ccc29636d549ab68c

                                                                                                                          SHA1

                                                                                                                          c2c903f90cfa1a4913d1fc89782101a7d66b5b73

                                                                                                                          SHA256

                                                                                                                          163fa30a3ff39c1a0a62c6296d7d54a97c05220c4bfa3a4e022a668bed605e90

                                                                                                                          SHA512

                                                                                                                          08f2f7cc93aea007ae0c166fe2c3256b57f0adcfd80c41d8d169e6c8207ac9e202ab3715ed63d68b501a821aeef79f311a50cd8c6c171d5d3a28e69648752909

                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                                                                                          Filesize

                                                                                                                          2B

                                                                                                                          MD5

                                                                                                                          f3b25701fe362ec84616a93a45ce9998

                                                                                                                          SHA1

                                                                                                                          d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                          SHA256

                                                                                                                          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                          SHA512

                                                                                                                          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84