fe6b90f7528013999b9c876a4d8185d29a8d1e7f145eeeba89631799154f4ab5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lt07vdx7.html
Size

315B
MD5

0b4add8e47308f50e116aeff7dfdca5c
SHA1

9fd64bd65eb0d86f8fd5893ea4ff974d1dad85fa
SHA256

fe6b90f7528013999b9c876a4d8185d29a8d1e7f145eeeba89631799154f4ab5
SHA512

b0b88c96feaf98572ef727ea449fea8bc7747784982e48e1356ed6e5c5d8a08a53d7c52504b6416ef00d68e6111883f91f46af9a8dbef1dc4f15ed2c2a2e179f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621575425427420"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3571316656-3665257725-2415531812-1000\{6EFC0D43-91A4-4827-AEFB-6B38C255EBE6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4920	msedge.exe
4920	msedge.exe
1492	identity_helper.exe
1492	identity_helper.exe
2516	msedge.exe
2516	msedge.exe
6912	chrome.exe
6912	chrome.exe
6684	msedge.exe
6684	msedge.exe
6684	msedge.exe
6684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe
Token: SeShutdownPrivilege	6912	chrome.exe
Token: SeCreatePagefilePrivilege	6912	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe
6912	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 3880	4920	msedge.exe	82
PID 4920 wrote to memory of 3880	4920	msedge.exe	82
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 812	4920	msedge.exe	83
PID 4920 wrote to memory of 4548	4920	msedge.exe	84
PID 4920 wrote to memory of 4548	4920	msedge.exe	84
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85
PID 4920 wrote to memory of 1112	4920	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lt07vdx7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab1d546f8,0x7ffab1d54708,0x7ffab1d54718
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8904 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9088 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:6184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9540 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9740 /prefetch:1
  2⤵
  PID:6472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9664 /prefetch:1
  2⤵
  PID:6864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9004 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9344 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8604 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=9952 /prefetch:8
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=8712 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10056 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5840657880498492704,8257210249460464733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x394
1⤵
PID:3352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa115ab58,0x7ffaa115ab68,0x7ffaa115ab78
  2⤵
  PID:6280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:2
  2⤵
  PID:6660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2292 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4428 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4700 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:7028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4848 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:7040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4992 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1688 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:6188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5140 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4680 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2896 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4812 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4564 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4560 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5364 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:7104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5620 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5108 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5876 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5720 --field-trial-handle=1892,i,14516643136796182925,15446097435824430338,131072 /prefetch:1
  2⤵
  PID:2340

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

Filesize
24KB

MD5
1fc15b901524b92722f9ff863f892a2b

SHA1
cfd0a92d2c92614684524739630a35750c0103ec

SHA256
da9a1e371b04099955c3a322baee3aeee1962c8b8dabe559703a7c2699968ef4

SHA512
5cdc691e1be0d28c30819c0245b292d914f0a5beaed3f4fc42ac67ba22834808d66a0bfc663d625274631957c9b7760ada4088309b5941786c794edad1329c75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027

Filesize
855KB

MD5
8c1702492df1067d07ee270629043808

SHA1
92ace87efeaa8421ac6e4fef1f7e9357bf54b914

SHA256
2945b7911fd41b2d922f75e002e3d823f84e3c8a0aa6a9711b8429868e110734

SHA512
654ef5d1bb6da5420a88a3b15c6cd50f72dc7e2fe472b69ce700816de9e77b49e341c1b96f5cc11c19093d0013108ba62562a662d93a6cca1525da542e364f93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
634ff7f8748087c7b47223eba7d5719c

SHA1
b7c624d92a269074a7a6d99cfb2589de3295a6de

SHA256
6880474aa0e47f99eb5ebe0b52a53e4ecd4b34e0c7c7e576f11ba4a97f00e0c8

SHA512
0d73dcc204d62b9015517c289516c0ca725651bf9e22fb215ef87a95f2caab223fbed124cad3244f93ae1965c19c55691f920f7912de2300635f518a31e31026

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
19e1b3036f54bac165138d2c4289a211

SHA1
1587f8a857177d84f5f19ea1b1e8421920afdec3

SHA256
ddf6f628de6c0ecf88a614eaf191442a00b1cbcf0bb000747f5e10723f4e173f

SHA512
492419992d9292aea8f2a57cfdee79f5b71c61112e0f03daae76f9d6efe24840ebe3cbc915066af7ff196b64aafd2ffe2d71cb3163418e0f350e4fc23e984d9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
23c91266b05eb0a21dce2bd4f9a7d84a

SHA1
d2fe4a4551d727bd1f051ee583b3d30588a865eb

SHA256
1253d80c50ec0d93d643594c27b4c65409d7028485086d5c22e6c1afd78e6f06

SHA512
413116d9019eade0cb9427301f136896bb9eac8ce2aaa0d5e488f76e9c2d0f42907fc63690910f39918db0ae46828ea7ee7c94819820d7ea186906b4fcb92629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ec31f2decb56482368eed2216c44db2c

SHA1
5d6c657914086f7330927f5b6ff8cb22ad6d5251

SHA256
48d9aac17d3a40ce8a622d87e6071e14adeb070020f3ced167e8b54df1d8f74e

SHA512
31c8f7f026df2cb684e14d2e950122394d6d43f5c11f7d6a80081f01525671b35684c798bbd11a82c41a2f1356b9b5d6c706d056a5b60d98309c7d012743a657

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
efa563de0a920de3c835464402769ba5

SHA1
b5096f3f10393102ef22043878909f9afedaa8fd

SHA256
c15b67c75f673f48fc6ac0f6deda7453730d38a82ec0e3279401c8b2454a08f7

SHA512
285cd1716d971b0aee83671d4f26398f923e4c699265af0a09a819cf7b4e1187cb2f528fc5f7a7bc37744749bd266339661c73a344fd570fca81c1da43e79ec4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe596fd7.TMP

Filesize
120B

MD5
0aa9eef3b9f767cea5b044a3df1478e1

SHA1
6b1a684e213a2f7278a4fa8f04ad477da7b856c3

SHA256
3acb810ca2ac9ffa19aa8c5eb28ab1c2dc14490a4009c741e9c4fc29cc137917

SHA512
b293c2178acfaea12c46e5d8ac22d2acf1176a0685f11cda9ebdce1ef8bca5e7ef6fc5973d0e8fb2568dfd8bfec0b2cce36ede62c536da1237f7ed228d0982ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
e11c532fdedcb06fd0c71fdd875e4af9

SHA1
0865573ff798d7ad535d51dfe27a81812db1e199

SHA256
4a4ae1bc8b0218b89bcc2efc9cbb82787025cf7db292bbebb6a0bc698ea1406d

SHA512
331a612192017e58a53e79ec892327b8c78abd221fb71c105bae6fc4369ada6d9594e628aabd450ebd886f5830aee2c27dc98cf01a1e38ef40e930d4c6628d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
97KB

MD5
6fe16ea9d1a67268f8e23d5bf8912047

SHA1
0516b57bfbead97360ae443e9b6371bc672aab41

SHA256
769a2d9c88d731df157e2f23f22bb5e0e739cb1631a5099e87666cffb726add2

SHA512
8262dc97459356c1dcb1ada27ba5a1f42eafbba1dfc833ecf072033db142d24d04cb578f79f97dd64c481a349fb1f1954b28632775f8ce0044c4ef1d1ecdafab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
65KB

MD5
e71ce1225cc150e7aff2898ee498cc09

SHA1
1cad04cb768dd20de93b2f7c58b4ff0482aea3d5

SHA256
a20352d0ed433d8c36ede8af0e89692d6ef64f4fd1ce49109fb9cc26713dc8c9

SHA512
c2bbecef94f611c895647370caad1b2a08ab151f88c3ffdabddc1bf7a948831e3897269acc6df12088b7b62a7865d89ca4a006724f04d4ca7b93d554136983e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
207KB

MD5
e955953b801c04327c1e96c67dd3c618

SHA1
f9061d3780f153e863478106bf1afd85132bccb0

SHA256
e8965a2d52ef25918ebee58ab6971745d396177a7943acf1ed53a65bb4dddd45

SHA512
6318ff1eb838954dd73dab5ed891d47f4f39089fa5e899d30183c32269c5620bd09d169af4cf8303e3d5c2ebab23cfe9ae5d9fa5c3281023abb009f66a25782a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
42KB

MD5
6db8752f85872107e3350da1f14d8afb

SHA1
b2785d7ef8bb95a39d0ea6c93a25b6ddd6fc6468

SHA256
04c070de8946a7b6e6dbb3447db337c534060e19e1dd72e238f1d0d255574c13

SHA512
34bfcf1613ce975544b34e05ad8bc1ae83c3744b5086090e01fe5695192f80915a60b74654db6510925a203e871ced60afb8fe76a9ae765a596010e7af4d9682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
69KB

MD5
c0b23ab60efb763d27f9f92b50b6728f

SHA1
259f669d1089469b1485ab4c07942c8f32431267

SHA256
c066161623da6821af1d38fb2fc8b5026e89caf02416be88d9543d1a0d337f1f

SHA512
0a43c9a501a2b462b19abca689815b4a8ddab19b1abef51072f86686fe6c20f555b9d4edc62cc41d3dff6f364269507a75da6d43ec11eec129d28a44857bb717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
19KB

MD5
635efe262aec3acfb8be08b7baf97a3d

SHA1
232b8fe0965aea5c65605b78c3ba286cefb2f43f

SHA256
8a4492d1d9ca694d384d89fa61cf1df2b04583c64762783313029ae405cbfa06

SHA512
d4b21b43b67697f1c391147691d8229d429082c389411167386f5c94e3a798f26c2457adf6d06caec446106e0f0aa16d895bfc4e8a1ff9e9c21a51173a923e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
64KB

MD5
2923c306256864061a11e426841fc44a

SHA1
d9bb657845d502acd69a15a66f9e667ce9b68351

SHA256
5bc3f12e012e1a39ac69afba923768b758089461ccea0b8391f682d91c0ed2fa

SHA512
f2614f699ac296ee1f81e32955c97d2c13177714dbd424e7f5f7de0d8869dd799d13c64929386ac9c942325456d26c4876a09341d17d7c9af4f80695d259cfea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
88KB

MD5
77e89b1c954303a8aa65ae10e18c1b51

SHA1
e2b15a0d930dcc11f0b38c95b1e68d1ca8334d73

SHA256
069a7cc0309c5d6fc99259d5d5a8e41926996bbae11dc8631a7303a0c2d8c953

SHA512
5780d3532af970f3942eecf731a43f04b0d2bdb9c0f1a262dbd1c3980bcc82fe6d2126236ad33c48ea5434d376de2214d84a9a2ccec46a0671886fe0aa5e5597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
1.2MB

MD5
a82f446f88ae17d9c9be8e037dcb6058

SHA1
d1c66e59b0d8356e2a9724bdf31ed782ee9f1f3d

SHA256
d53f6685b1676e9dad920f32037c602b3208a3299e854464f6a09101dcf3efda

SHA512
889848bba0309df447a1ae57a302a25fcbe5c96bc57d9c852220eb84473c031f8285702afb5c2b27a7d6d5f4b0deef89bac8d011cd41cef27fcc689de1b70cf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e876784a0f3afba2e2fb24d92c10fa79

SHA1
e896cdd4786ec398a4b442c159523d4093485a6a

SHA256
061c92ae4681762359d3f6e22cc57416af364161ffcd2cebdec5f640056e6a1d

SHA512
8679b1bba207cbbaecff9657cacad122f1042c5d828b19690f58f87331b36f2bb71b636cf70e90274dbaa3e432d0328953adca5167fcdef8620df0aa033a3b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7baefbc9923e07289daa12b99294da9a

SHA1
c9e226bb5f34e8a277a5beb79ef1670dacc3b8ac

SHA256
b04fda67db69b0ba21b69c60a9f87d7a1387fce1b023d1065e2a21de84e8868e

SHA512
6ba45d433d384bb9ae0537865d338cf1c317f2ebed062639e5b1f9c599a3176d63cbfd82abed3e488087655d29c5381bc3a6c7e6c80d2a8cca499b788ba0c672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
104412a60d00a17f8e0c1914f2b5bd71

SHA1
018747e7ecbe4a5e972d8693e836bf8a3af0f969

SHA256
1885a7484fb0834d7471336e56a42307d1315a2520b5958b3a0a613819b24a66

SHA512
d40258dc3ad54810c7513cfa1bb83c9b4e726854015e549ff3a15626115155d4c98c180b78eda048a0aaa4d3d32865fdab4cee14ba208bfd16ecbee2ebdd92fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
0e948a9853c6daf4b09827015c4c19a3

SHA1
7a4798d0cd8ed8c96cbb0c6abc5549c33ccfb676

SHA256
28ca04ad2e16d4dc23a9f8bc30f07820c40bdd833da861afab2f819860245eb3

SHA512
31dff4bcfb46469066806241b9918ccee945cb172816a9360fa91c82da432370c26dea3727452fbc09bcd05ade097f7a3125733103c905441e5a6200d369496f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
e6f8c3ce1d0fcaa10814ff0c6e015c81

SHA1
30eac532cfe131e7ac7087cf771894f1852e732a

SHA256
88ed25ea486e51d868f3b9c675529ceae86520f2491b14a744140204c81ccaf7

SHA512
26007d1cfea319689387783152602ca45826f839e65e180213a2456e61cecb36eb6655b07144d051e794b261a92408fb832694facbd37899786af6ac44da2f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d4a1afcedfbc97085a2d1dce3fea651

SHA1
50bf37b2c07867b531ebe788e38235fa681a6acd

SHA256
13a826b5bfc346cece170caeb7d198f25b066355b380c7ddcfe555d7716d65b3

SHA512
afe5e1a391589f662e0e7ac70298677c4d0085849b69b8060c6f1e35b6c18a829f4841985c19963ea9cb49aa3a890316fe03494f1cc14a781df73ca830189670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08d1ebc7a33fe4605d7b21a1eb9d3a47

SHA1
c06900cbb54f8afae7efe4fb59c613cfd13dcb0b

SHA256
8e210fdf28d72f93da96d8ea9ff036d0edf1882a983e38cb3017a3d0118edac3

SHA512
04d2c1a44ce6d35826507257020f8ba403894873e83e2c3994911fd4580295ccf87bd5413efc397709fe4fad685900119d5226c652c086b4040a8f6eb0477a8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f88eec3d56f65a8afc4c661b2889a976

SHA1
30b3cff7154ac106fd7556a3984aaf581b9acf1b

SHA256
3a40bb3c7447c374e7c0aab251e68ff286801183e1883cf1578afb802187def2

SHA512
9e2ee0bddf6516645feeb36632701181e3c9574be1a5a484e32a351c1b902064160d8ad6f60740e815d6cfae1530d651851a6323df6e38c8d0f63a28112dba07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b0e0eba237c1b7426ccbfdc74ff90207

SHA1
0921885d366a83548c53297c73837d281bb5bb74

SHA256
74c39f1424d8cb5b75f38844ed1941fc55781d4ad7fd4a4e3c9c8bafddda806e

SHA512
fa0e89d2c0824c28ea4e5c07d80b12c8588e8dd2ff956161f03e1869703f92276f4747e3843ff0906fe0e42cda8a72cc86f1d4fc88ed46590c23258a28d7f93f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
68501894853957a494d81a350aa1ebbd

SHA1
dec628de2177155bb3fdc9c0ff848ae12d84fe09

SHA256
7c12df45ac2d9b3b0f1bbf34638a3226ab7d8a2f7682d54369aa75df7204068d

SHA512
da5bf3b89ecb77ed47790d4802bcf3190eedb50205cf7f9c0bf67aacf09a174c4c61b2639f4498bc9c22c3847e2a4c6574fe3dd43de731e86a1a0fc05697614a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
440490922ed71223f0fc542f3f3d7d46

SHA1
811f0c79b5864dd839f88c06ed18ebfaeb3c9083

SHA256
c656c55fbec2dda743c5d16fb50e760441f0f7794f916b54dee7384e5f891bfa

SHA512
ec123b4744be84930bb4fe2c60b6d1648756d7b726acdb59921f5613df8201edfee324dd057616318e5b7ffe37d22b8c10809b1225af23fb07a94b3d1335e026

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6d7f5e1f73c74aba53a4ada1afef8d71

SHA1
bd3a4d8b5e360c927479cd444b4a83ccddde8f03

SHA256
aa5f31b29901701bfdc642cf31142f693e4d70d8dc00f8a90460cfb3f1a39dc4

SHA512
5dc831b46a03b6b541c259fd265fbfa5b7d09602145e4a202034b7edfa229db84836d61e032df68f34c239bd9f7978829075d4da4a664cb4d19096e13c0b7f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0221c1b5129269261a28d6b817aa2a3a

SHA1
dba8e2e19826c7f348f568b73f672b69f3f54d8d

SHA256
1fe3e64cbd5b4491ae4a945f2abd28d27eb3a4398419bdbdaee6688ea33c427e

SHA512
3a76eb83fdba330f7b878da69f46e6c067385606ce62d99cc6317650d8eb11519a23b92503cbc7351986ae7b6c05536b0cd5e53b378c11b8a974648001efb664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e01f.TMP

Filesize
2KB

MD5
cb476b19088bacf54e71274e82b00be7

SHA1
f4df83336e6ec681c6d1904d671ecdcb1a191806

SHA256
97e83f78b2ce481c9c0f226a24eed22635625db471ecd822568a95a9283a43c4

SHA512
0110a238b23dffb7d4c0982013d25cb29daa9b585db409f79be05afb2d6df74d72ea3c63c64e3c0ef39264f6c0ba3ab5caa69805704931b952f883f0fe4816a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1b8be23c62370696b5a1059e2d8d8d29

SHA1
d1beb38b184bc8df54245120147ceaf51783bc34

SHA256
dc722f77f94b192365a62259a2f13dc1e55d9a607643c9b86a9db6df6651066a

SHA512
6b0eedea47b44e25f8b17af5d25696741c40d7d27dbb04bf99eabb9bf3f9bc14b9d708141a1e278ba53dfcce6d83862381e0ffc6528b632ed1b34cdeb2136ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2ed1b61a40684dc28f1d89cb67ba9871

SHA1
ab24b2cbb7dedd1d9ff9553cb62fa27d3e96b64c

SHA256
f78794b9c9c3db8c9351959415e278b718c269edcd7a36da56474a0f2e1efed4

SHA512
7cea2810cd91b4e13391c8a13e1e27db68ebbb327f777776b35c400e866f5e3851600ea0d60a1b007c0b3cb7113ee057651989f4b6c15b6f4c0d852085c87108

Download Submit