Malware Analysis Report

2024-07-28 08:43

Sample ID 240610-qanexaxarp
Target Minecraft 1.9 Survival Let's Play S01.rar
SHA256 3ef5bebb9155874d70b1a6633815ec9720b2684313ea357488a9cd5fe0642e27
Tags
microsoft phishing
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

3ef5bebb9155874d70b1a6633815ec9720b2684313ea357488a9cd5fe0642e27

Threat Level: Likely benign

The file Minecraft 1.9 Survival Let's Play S01.rar was found to be: Likely benign.

Malicious Activity Summary

microsoft phishing

Detected potential entity reuse from brand microsoft.

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-10 13:03

Signatures

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

90s

Max time network

197s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Village.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Village.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
NL 52.111.243.31:443 tcp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

90s

Max time network

206s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\villages_end.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\villages_end.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

92s

Max time network

205s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\level.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\level.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240419-en

Max time kernel

135s

Max time network

150s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\Village.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\Village.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:09

Platform

win11-20240419-en

Max time kernel

292s

Max time network

297s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\level.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\level.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

89s

Max time network

195s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.-1.0.mca"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.-1.0.mca"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

293s

Max time network

299s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Minecraft 1.9 Survival Let's Play S01.rar"

Signatures

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3062789476-783164490-2318012559-1000\{E73D17AD-8E69-4FEB-ADA9-1133E2046A0D} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1940 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 1312 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 1312 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1940 wrote to memory of 2248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Minecraft 1.9 Survival Let's Play S01.rar"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc4b6d3cb8,0x7ffc4b6d3cc8,0x7ffc4b6d3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5404 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5396 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1640 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,12638032802901628678,2054918013061552480,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6788 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
NL 23.62.61.185:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.113:443 www.bing.com tcp
NL 23.62.61.113:443 www.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
NL 40.126.32.138:443 login.microsoftonline.com tcp
GB 2.22.102.181:80 windows.microsoft.com tcp
GB 2.22.102.181:80 windows.microsoft.com tcp
BE 104.90.25.175:443 www.microsoft.com tcp
US 52.96.223.2:443 outlook.com tcp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 175.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
GB 40.99.201.226:443 outlook.live.com tcp
GB 52.97.133.162:443 outlook.live.com tcp
US 13.107.5.80:443 services.bingapis.com tcp
US 151.101.1.181:443 play.vidyard.com tcp
NL 23.62.61.56:443 cdn-dynmedia-1.microsoft.com tcp
NL 23.62.61.56:443 cdn-dynmedia-1.microsoft.com tcp
NL 23.62.61.56:443 cdn-dynmedia-1.microsoft.com tcp
NL 23.62.61.56:443 cdn-dynmedia-1.microsoft.com tcp
NL 23.62.61.56:443 cdn-dynmedia-1.microsoft.com tcp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 mem.gfx.ms tcp
US 13.107.246.64:443 mem.gfx.ms tcp
US 13.107.246.64:443 mem.gfx.ms tcp
US 52.167.30.171:443 fpt.microsoft.com tcp
US 13.107.253.64:443 acctcdn.msauth.net tcp
US 20.189.173.3:443 browser.events.data.microsoft.com tcp
US 20.189.173.3:443 browser.events.data.microsoft.com tcp
US 20.189.173.3:443 browser.events.data.microsoft.com tcp
GB 52.97.133.162:443 outlook.live.com udp
GB 2.21.189.25:443 assets.adobedtm.com tcp
US 20.189.173.3:443 browser.events.data.microsoft.com tcp
US 20.189.173.3:443 browser.events.data.microsoft.com tcp
US 152.199.21.175:443 logincdn.msftauth.net tcp
US 152.199.21.175:443 logincdn.msftauth.net tcp
US 20.189.173.3:443 browser.events.data.microsoft.com tcp
US 13.107.253.64:443 acctcdn.msauth.net tcp
US 152.199.21.175:443 logincdn.msftauth.net tcp
US 152.199.21.175:443 logincdn.msftauth.net tcp
NL 23.62.61.97:443 www.bing.com tcp
US 152.199.21.175:443 logincdn.msftauth.net tcp
US 13.107.246.64:443 mem.gfx.ms tcp
GB 23.206.77.131:443 res.public.onecdn.static.microsoft tcp
GB 23.206.77.131:443 res.public.onecdn.static.microsoft tcp
GB 23.206.77.131:443 res.public.onecdn.static.microsoft tcp
GB 23.206.77.131:443 res.public.onecdn.static.microsoft tcp
GB 23.206.77.131:443 res.public.onecdn.static.microsoft tcp
GB 23.206.77.131:443 res.public.onecdn.static.microsoft tcp
GB 23.206.77.131:443 res.public.onecdn.static.microsoft tcp
US 13.107.253.64:443 acctcdn.msauth.net tcp
GB 40.99.150.146:443 outlook.live.com tcp
US 52.113.194.132:443 ecs.office.com tcp
IE 40.90.136.180:443 storage.live.com tcp
IE 52.138.229.66:443 eu-office.events.data.microsoft.com tcp
US 13.248.245.213:443 eb2.3lift.com tcp
US 13.248.245.213:443 eb2.3lift.com tcp
US 151.101.1.108:443 acdn.adnxs.com tcp
IE 52.138.229.66:443 eu-office.events.data.microsoft.com tcp
US 8.8.8.8:53 108.1.101.151.in-addr.arpa udp
US 104.17.73.206:443 info.nvidia.com tcp
IE 52.48.226.150:443 accounts.nvgs.nvidia.com tcp
BE 23.14.90.89:80 apps.identrust.com tcp
GB 52.98.201.82:443 outlook.office365.com tcp
NL 185.89.210.212:443 ams3-ib.adnxs-simple.com tcp
GB 52.98.201.82:443 outlook.office365.com udp
SE 92.123.135.89:443 res-1.cdn.office.net tcp
GB 20.49.133.244:443 cosmicpimg-prod.services.web.outlook.com tcp
NL 185.89.210.90:443 ams3-ib.adnxs-simple.com tcp
GB 52.111.242.2:443 gbr.loki.delve.office.com tcp
SE 92.123.135.89:443 res-1.cdn.office.net tcp
SE 92.123.135.89:443 res-1.cdn.office.net tcp
FR 51.138.217.154:443 consent.config.office.com tcp
US 8.8.8.8:53 2.242.111.52.in-addr.arpa udp
FR 40.79.150.120:443 eu-mobile.events.data.microsoft.com tcp
FR 40.79.150.120:443 eu-mobile.events.data.microsoft.com tcp
FR 3.162.38.95:443 login.nvgs.nvidia.com tcp
IE 52.48.226.150:443 accounts.nvgs.nvidia.com tcp
US 192.229.220.191:443 images.nvidia.com tcp
US 3.233.158.32:443 rum-http-intake.logs.datadoghq.com tcp
BE 23.14.90.75:443 exo.nel.measure.office.net tcp
BE 23.14.90.75:443 exo.nel.measure.office.net tcp
BE 23.14.90.75:443 exo.nel.measure.office.net tcp
US 13.107.246.64:443 mem.gfx.ms tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 704d4cabea796e63d81497ab24b05379
SHA1 b4d01216a6985559bd4b6d193ed1ec0f93b15ff8
SHA256 3db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26
SHA512 0f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d

\??\pipe\LOCAL\crashpad_1940_XDIRYBOEKIVPHJRX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 de47c3995ae35661b0c60c1f1d30f0ab
SHA1 6634569b803dc681dc068de3a3794053fa68c0ca
SHA256 4d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7
SHA512 852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e2792e9d5077621c07c6e9de4e7a942f
SHA1 d9ccdcc4268323d0da0b6dc87ed2d69d11dcad06
SHA256 ca8321cc0eb389d952338843032bcc0f482c73343b534d7e655078df068cbe31
SHA512 29fc27efd68eb566c9bedf7a8ba5024bbcfd67773bca853a77eeb78baa83268b8b8ff6f9a5894216a01a24bb9cf02cc7249ba9d466a3532424d6c229929bce9b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7fa168c1932f73a773ffcc5662b87dae
SHA1 1bf76968acc5e55ed1bc0ac90f24481c96e0feb7
SHA256 f148f4eacb2838a6692eb9311dfb6d8e1f7b48c20af7618d5fabc0cb22c3b740
SHA512 f1a7b39e54d86ac9245c37c053f92f6247095e451a48e77ec977d4ccae776bf2bb43eaac1284e976351da64217f7576652af652c0385501c07a0ef84f59f47aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 74d429bbe5606f0317fdbd138b0c7b37
SHA1 fa0a2140a226a30ef39b5053c325d020ef339b30
SHA256 f48d04a7e0f2a9aaefa4b353041fe0ca90abcae9a1b6c243402e8529eef19bc8
SHA512 3e5b4bb7e8712880c22d4e2bc0fcb42c8b0af1d59decccac2153231c7aca5772142a38c29d77a8f98374dab7b55b07e7d9380bff512adb25a8b77d4621079ede

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ccb038bfa3ab0f0b301d80f6d7a0bbb5
SHA1 cd33cebeff2f5514bf7c86528a8ef37aa8884fe9
SHA256 c2fe2d6d56f47ab3f279b128b3deb92f9d323ca4898bbf8f2a39084a45ca0591
SHA512 c9618242b93d84af93b2ac277cd6dad1bdf5e6761f2cc53bae0f5800128bc5716b9f0f4aa45011cd72d9b4e31e94511a2057c9b691d34bed6d712051da6544ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b66f.TMP

MD5 46c164242e1e1c2fc154ba0fe65e40b5
SHA1 9656b97774f74137cddf28fc80eb89f7684bfd47
SHA256 37901da190290b0d656eb1c46d198bd748934e5453a320d6b426936d48daf301
SHA512 a4b2c1da2a8b29cfec3ef3d1dae6c5761407376c96dad330714491f20154f09a251f1057d95b909d1e86473e72f93c28fd6c700acc37f92fbaa397b125b3cac4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c82c8d1b2b2b690c89a3ec537c632bf9
SHA1 075e16c9059463137078848f5e1d29246504fd93
SHA256 0cad6c2f18e8e68656c29a3e8a02fc0423d88077ebf4b87f7346061a66d7797c
SHA512 86395a455001d5d4ee09ceb604377c340a596a5286aeaec043e6bfc11fe39c4992e3df16b14de7bb166eeef1f4e8aefef4943021e9c5a5a681e6c548e09c0b3b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 da1c78c1c44219aea394e3cae672048f
SHA1 668c98ac83c41a1ef41e5e7d7d56a31d61b5540e
SHA256 0920975da9018c2e85fb2fca206a3b9939a1efedfe5874d4ff682041aa206161
SHA512 8a01a9da65a1ae72109477cbd5e873147699801b9bfdb8c3c04606e7cd272fa878b97c160d4a031b2efd8c1106ce7b743a07ea6191d241dc3016a9de9af5a9cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d6053ab4f148ae07b1875c6f61c22b85
SHA1 c6102d3d9ba6256363da1d31a5694c006efdfd4d
SHA256 88a69c214d17fd99eac64661bb6c2474872bcdc12a236dcf555eaf0d69590d4f
SHA512 e9cf58a4d9d059c3b91ebab0fe38c2a56c04e26702bc65add90d6432695c5513c13037f2943ad120c90af1b8ea9c6574c5abf27574a09425f9b8ed7027c6a92c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1b64de273bad03541971ce9eb60a2dbe
SHA1 ad9de53ac8cbfe29b7ec659e604153e48b5302d8
SHA256 c820a8de396efb3afc7e3c4f389fe1fdbcc4503927097aa1eddf297264812bfe
SHA512 bcc6dcddca0d7aa34e4f6cb3e8025ba0b94b53ef81f70bcce8fdf9fd9b89997aeda5cdce17f6b1b9c07a92d2c48ce89c12b86e843fe732cb892752d922aad1e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 08cddd17ee460fc30ec223ee01591c85
SHA1 9869877403bd45f03e1699df0d7524a65844aabf
SHA256 b0a130442f15e6ae11ffc47fb4fa6475db6380be0700494170904a7d4f48767d
SHA512 68a9d903d3f9262fb8f70929499b53926b90aa9b17eec0862e4d528bb0647e2658aa140d21115c1e8946ccaf9f9274e9a4561b3ccd159e0c38f7c6131b4b04c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f6599dfbac687b0ba5d2afe358ab4be5
SHA1 a8f697a812081ed12197751a66c0ef822e9414aa
SHA256 bd7c53d9b2343c675e54ce1052e44225b526e42e016ef1873354753ff3be20cd
SHA512 ad85e2d76cbb26cdda71483598226afc4cb359588896513cf09b4b76f87f8aaf06542f58ce859e9bbecbb522eac86665e21ceb736da60de0b8ecb152d1c87ef6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9af84aee89848aaf72a34d5acef9bea9
SHA1 bd4637a938e86b62094fe9417bd0d36ec8ce7bea
SHA256 1bbd1e7c2a21ec4182fefd40af2257070bc6a4a1bbc513e485f151162055dc2a
SHA512 984ffb599244a4c3d15a6a592e9768df27d0786baceef670da66828d3a4cf3fdac511e12cce683bd4295ca8428a1a686e08eb0950ac220faaedee91c49408efa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 550e1fddba3ce795b15880f7f6f78787
SHA1 feb2ce5e276de3c9175ff56089b212278c548b37
SHA256 354ae20e856da1175d91907952f29e3d159de9e514a286553a30f2cb44f2a0ed
SHA512 0602f5f724987ee6852e8e23f599fbedcc70aebe77b8acadf81d63ea66fe2a3ef53f7bc826bae33b1c9e3a60364ad5f4654ed104dc65c8728c219fc5dff77af0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 11052024cc09920fb24f7906dea08a2b
SHA1 d9dbcfa298795c2a225cfcca93b40c50a5a6e524
SHA256 07fe06ad3bd66c2f77d72d42c2934e8334804c6a69243dfb9ebc048b219f40a3
SHA512 24c9f4b0dba192187ecc2457b8b4d3026f9ce5c2347d28f62cfa0ea1880838d2e9489375eb9425aa060e7805212c6f5c75dfb4e4b36d7a81cd35b1d266cfe4ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 07fc3b8f7d7ed4eb838485d5405a0d82
SHA1 39d9951af924bc99f7402ff6d20a8574a6bc503d
SHA256 9059b562e0c18c6c5c53fffdfdca75ca3905db0f8c8f147d0d916cd34723e224
SHA512 9651b69656e5671ca050891e7f5ddb636474eca043b679232751a6450eb2239723563ce6cf6f26c47e6ad467e9890d7b3a13b4b2813a449875ed682a0438dbb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

MD5 656211d9a76bac600919c90942420204
SHA1 b8f12a890f1f0fdcc58b008b2ff35f95e92a4fef
SHA256 603f4ba8054778824e353f0ecdd302f07d7b4311dd8df133da0b4cec27f6aa0d
SHA512 4c73af8ae1f3f27af2bb41e279f67448ecf7f168657ebe3824fcbf182e32a02dad37006b6a5cb9a1a6319307dee04a09df6761e3acfb24b2f4652745df27f438

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

MD5 1e5b765b32c5f65973d835e9ee3ebf20
SHA1 2ae4b7b8e6303dbb2424730062c2fb1d752219b5
SHA256 d443b4a9f2542caad44e23d0d3917456e781bab47cd000cdab5a2aa571395379
SHA512 0ec798c3379d4724f5168a51e2bd8eba221f629ae41749b444cb1487b5b16a01e220857e181c710babd86c0201593aef9f8c21291f57bf14d5ebb72246958665

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8aa7ff97aef68239c33174bd9bbabf3d
SHA1 d0c3e959bb6d52ce263e88f853eb583fa361cd5d
SHA256 8a5e0c1ad99651c5e719a60f1911e291ae9a7db16fcc0d4b0cb7926bb8527ac9
SHA512 1f19a7580d2a977788b7f3d1e1c4f5bf61e75791cf54cdfb7bdc61d56824d7da71025d7a967c0eec30c749b6e40888ee02c66e9c4b645b9ebe2fa38e18bff048

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2c25438f812e4f469af14c7b08c10f32
SHA1 0fc8b2bd65356078252790b3cfe52035bee85cbd
SHA256 5f839d0c430aee57e6bd93e3f159caed6239e59fa5a636ceb77349f521f6c8c6
SHA512 fc54c07b1152c2b190bf05ba933bce9e67950b6254df8a136e1217e7bb58bf919e7fcc1982d50a734744997100e440d8e0998c7be47361a3975cc6501b0c27b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a6076e7234b13bc7bc22b91da83e41e3
SHA1 0b149efa522d2ca00f151dabd02285328d43af3f
SHA256 ace8f95b9aa0329f26b2e3b5ebfb2fb5655a573be68c2f32e25233c1a28d08f3
SHA512 54a1d7ab8a724c25b843d35b14199960ad095bebaebb056c4f54f7ffa5214691d5e9d9c0602fea2b8938cacc9121c0776f5e6e1982d0d0195e15ae55f65a01bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8b87710bca0d8b42faefb8fa416aed5c
SHA1 8e697cf97a545bc5fb1bce25ae15f4f869c750a5
SHA256 374ee0544bcab63a2d7e59091ea8fa5f4f994d1fc1552316a39fda2b0fb7b323
SHA512 1e5fec418da142b670d1c970c9260d70218601c0e2d8e3eb9583d7e07eab1ac1510b5726bb54c373c6a64bd4e325ba234906c6480a405ffacfd9c2d646d4f6a1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3d07436a823164f74cc823b1e61a61af
SHA1 902753fd7efe5bc783faec01065a74f41191564a
SHA256 e436ad463a7fa080548a4e3420a10b50f1fd1a42aa86bfb50921f77eaa74fb52
SHA512 2dc9fc67b8a6d74efc093d3551e3d98604e4f0d893eb4b8449d850aa33b72b68cd760fc1b34a1cf8d89113f075727fe840a4b8fbc6b1c7799ebe6ec8e54d00ae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2967ce5cdc99d1868fb6898115a649d0
SHA1 b164182ce01832fb1a063b74edd42d8a929488af
SHA256 ab9eb4937afa401efc1ba7a76cd5e909fa608899b799a0ede4a1ba476a1cce6f
SHA512 0d2df8806cf7ff3da24592e53841c058fb8ff87625e078a1e406c38756835a6b0f093513846b34b8f3bf56988a0aacac7a8751863481eb383b295ce01c159d21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt~RFe5907d6.TMP

MD5 45bd6fed86a647db0f8272ed72c356cd
SHA1 dced1208777c1b6a4a76f0918e73228a1ee8d37a
SHA256 b329cfa503038345344dde3834ad5f9c06ef792cab2215a89f86e3cf34114bf4
SHA512 315a2ea5efb4645f31c11cb5f1b8f1fa7dc2be6df8e7af4e2b3ef9fdce3c098df6e15ab740f8d9dc0bd87e37c9659bbf76ba2207761bab4a30daa3e14f30c24a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt.tmp

MD5 8e4c5a7ee6c54e885f427f512f16047a
SHA1 1298f9e4b6b10250819c854db5e0fc4ff2a704a8
SHA256 05f21b68e74ada595d2df67ac093cdcc73e3c7f69bd6faa49bbf44d51efbac94
SHA512 de3f2d11f86fd6e87567bf8e32db1289f1034bdc9a46dc94e8d023c851cdaf85130494ea04037eeb24e1c806940d7832773d4214edf8d3a0212601172e2e21f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt

MD5 57a194dbe41820c1e7ff995c0a85a80d
SHA1 6fc0f7b171dd6940877c9b239abd5c2dbe44ffd1
SHA256 d19e048dc061331c4e6d380af4182892efc4fa06363f56f51bfb5259715bc88c
SHA512 eb07057e1f50f36c2e5daab42fe7ddf4823303afe1443776afa53e0bba6e486f02ad13b8186d303f050a893dd7a7419a5cdd99af6e282a1e78eb673e24cd48a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt

MD5 97d5f65881dcf1370e0f450c74916071
SHA1 8356aa6595b01f1b3d60df82686d78c6b573c033
SHA256 3ac8ef666dc310ef3a2a6f90247aab7bcbdaf26b21147f7b06f1bd39bdf848cc
SHA512 7e5da137492e2d0f42cd6a7f1b36fdef012af3282eeaca25b3da50eeb5420b199fa65bcc6d3f67da371c31173a10ff06804a368872cbf4b63f9beb44a2d30f4f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt

MD5 7bfc6422a71021ee2c0b3741bac56b72
SHA1 a596d767b4b0cde1cf6abc1e24bf9f769365c2fa
SHA256 5251f672664bbe6a453abd1e64a82b0856ca77768547a67c8af68686a71ef958
SHA512 72ab8dbd56d9d1d23bb3ec5b10f2bd5188eedf0da302b53b1b1292acdc77f20cfad94d97b43e550dbee7fa6c0511c0db1336adbab34ebd7f8cf9733a618e4142

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\a8f51067-218b-45b9-a744-21c6bd85814c\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt

MD5 2a12f32ab1074dc9f589313e61d6300f
SHA1 81592bf19e9b1da6b1c8e05733c03b68ff2fa687
SHA256 82e43478b7555b40032dd866f07b8e611c1323b1c74df5e2cdc554b986badca7
SHA512 db0a63a5cb96682ba57fc253964d24bf452920b088ad1a3dcc677f7ea6dde3996d21c139e5e3ba08c04ab0c7e2f894b32b3b28e973f5ca6a8a04ab08854885f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt

MD5 1a67378f6b6e89eab7b4f5289718e7e0
SHA1 4df92ba895d8b86cbfc7d1f56704ff742577bd32
SHA256 1982034208f8d840c0dbd9f6a7abc6515473b21ec9f0e5140a363fc8ff6d5400
SHA512 a7fdec1da70b8df3f8c3b35aff5f0e4d59ba55527a358872b859fc6d32b355846583b044ccf36419ed54b0ac511ccdea369dd57e3778c720868180a6df667a2a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c5

MD5 9d445aa60216e8860fee9894716f1c24
SHA1 6f6b0c3b5d4d1c452af7aaefba88b447436ea50c
SHA256 f987fb6723668f43633dcae774adcf7f8d496e9e693fe9b9f766006d3883575f
SHA512 2bc50e3103ba6a98280d63ef67d879c5d6392882727d8c2255d95449aa26e038acef1a301d778014fbf11c272725fa8d8c85d6f2968d45ddbf7fb2ff2ad9b182

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c8

MD5 1e716406133e63853729cf416f065351
SHA1 e6a54a42a36bfb5c781b6873a79431b11e016f24
SHA256 241d46d249782fa9b9163f89ccd2d1537b55a567438863c46001a86cf12eb3c7
SHA512 d3aefeddd21de9f8fef8ec288224131f78049475ac449b193bb31584bea25b6844bb4f75d561d93dfcd08d7f442f659c301ffec210e03bf4f3403e994c63156a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000cb

MD5 12d0c6aacad574881a5f55670e94c11d
SHA1 7aadf8d1038e32609557c5169f45ce77175b42d6
SHA256 3b455652ce5f370e939b8c79efca8193db3a55924d68650f584c963859704d54
SHA512 428dcde26e1f97d8ad74f8f9f33fba5d74e8c4fb869119cf36d236a8586ff7223490ffa988a6dc7df3e912a471616c3cab676056dcfb9835698f050bbaaabdd0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6a8e7ec6dbde4bbd1c889f2ec4d2fd15
SHA1 36efc50032ef9e9af5bc894462b8c205593d0629
SHA256 15964bff8790b68ce68c02f3007003675f3a3c02d7142047b567f55076284fef
SHA512 f8c1f5dd0f305b2562b389adb165516fccbf6739cc3ca0a0d5e147197a3297b189634add4ff62a8cacd47664a2a58678108d3839abf1fa4c3a977568a672a9db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000105

MD5 70a56a53ea0a4817270909fd611b2190
SHA1 5d117d612e344a227583fbe2fa0f015bd265b10d
SHA256 2a4d27d1dd6e38e26e4f931305f546c24f9bebaf6fb57ae93002f73caac54e94
SHA512 88a54ad0ab113bfa470050257e5d041b218d5829e93514be83df935f9d04bf46e86c9527e57d895b814eba33ece32adf5c7fd1582a43b6b34a2d276d02f52c3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fb394f99839daab1faf5c14ab1f599c0
SHA1 1674fdf5276a301ef22226aecc8fb1fa30a2d809
SHA256 9c84578d610325d3665a66d12895947a7b8e4edbca1b4f14d8fc5bcd6ad64814
SHA512 a58339c05b7f7489772951bc2340847340dfa131bcb3303ce5baf92fb84603939d96801fd0a629255619d713f95bcd599a1593976c0c0d781b3f5df661b8230c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 62adfa0c07f0e435ff317a590e0627e6
SHA1 86700c0a198fc743e46f3360a04fe1de1c22fb29
SHA256 f767fc52f3b0a37f9c14514f32fe73a2c676bedf898681cb32672a882d5f8ed4
SHA512 c8d135686d60be5596851f8874472517aae6ee93be38897bb22b59d1cc42667102b07f7538ebf6552826e26706767dfed682a7cfe168302873ccf37d8451ae6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595606.TMP

MD5 d617564ad37fb2739b2529a3c760fd38
SHA1 75ef9d490614e71af2f726d2b78238c44f2a2e10
SHA256 25c40f7dc9903ff70cb063c6d199779b252d8cc5beea1f83483fa8c20fe8b802
SHA512 762460bc8afc1e9b28a7e9deb88ad40a492d58566cc2725fca14059ce8e775838150d5ed00b7d61be9b1d253d2d6f11defd936ae9b8f13005090bbe901c707bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\6a98de5a-3281-490b-a8fc-6f9c0bd8dee2\index-dir\the-real-index

MD5 a600f7430ba56355af71d2c6c0a9bae0
SHA1 7fe8eb2bbe3bf8bd893aa9ed88be7ac7c5b286b1
SHA256 f7fbc65fcabef08536915b3adff4c7a9c67200630d7f2faa75138a3540326e36
SHA512 10ab7d394ae84bd83c7b500aede40c856cbc2583bf2581116e908e20baf580fc706866744c476a606639c4336a69807ccee0f0c4b4a94cf5ce30bd9ede5166c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\6a98de5a-3281-490b-a8fc-6f9c0bd8dee2\index-dir\the-real-index~RFe595625.TMP

MD5 c1045cd976a060a199292a8c42e6e501
SHA1 e8b5937cacfe4613268e7880fb6505a72b11238a
SHA256 aabbf121b7d5b66a1449835da9087a027f9368bb882c023911e1554da99f65d7
SHA512 8b81cebdd247d505ffa65a32ce40fee591b7bba365b9181cf6efb30e6552607a90fcb985bbabaeb9ca7854eb03bf221f10d16e8850400f643252c07c12bf1734

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d84be76cae7562618134d4cb92e7a99c
SHA1 92313b05945987f8a1e885a22b2a598f37d36045
SHA256 929372a9e9738342510395d66457061bdc3324e5f78fd3e0e6b2d0e98b661aab
SHA512 a764845ba694027edc515f0208a508e0e15bc2c1068d80b20c50293d893721109f3168d3f084b1b7dbac672f9d995c7eca2aff00d3fc92867bc1812be46adf83

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\a537db48-02b1-40a7-9aa0-1b20579f39b4\index-dir\the-real-index

MD5 94b51604719c8ee83f1ac89001d18b44
SHA1 4cb41100e467eec04a2166e86b6d69320f6c8baf
SHA256 c3a26cda76107c68812b5e67f7120b7776cd6d5e4fb4e21abeedacef4f05569a
SHA512 b68d278411fb8f601730dad50f2a5cb36abed6f3412a3ab3e1d6841c1fa45428ddd59bd2196019f3fcbb8f89ed2279f3b1154583ea43cbb9f53ef3d9e8d3c5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\a8f51067-218b-45b9-a744-21c6bd85814c\index-dir\the-real-index

MD5 6c6a42fa050428424351d88e2d71a147
SHA1 ddabc422832fe781333368d823072eccc039e30c
SHA256 1636b128f10e14750797cb2463c52f3bbc5b636e3571378a6d70315e52b1b08e
SHA512 3e7f6387b9de606a9c3c2b7fe59ab9cfa1e752ecc3c18c2dc0985bb4eb6d794927e0190d6423699ae32ba4f103b521a81f630902afb9b1651e3c82f186dc397a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\a8f51067-218b-45b9-a744-21c6bd85814c\index-dir\the-real-index

MD5 4ba8053a72b26df71c6ce37381191613
SHA1 a65a5beaf85ea55616d7cdf9b5da0d4459e2ee0f
SHA256 b1e8082585f60002f1d7a51fbce98320e1bf38ddfecdf0a108f0c4c000dec38e
SHA512 ade0ff945cf3443288cec39cd5296bc7a1c5000b4530edcb177d45e45730de7bec8476658b834d7be1ed94c26847bbe140389745a65c70888bf86dd7497a6ad3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f48a22277f64c442756e922770a3faedfa75bed\index.txt

MD5 608eab03d124ac33bf023366011b86be
SHA1 57eea9ae6328a50485e4210b1c1f463631bdd880
SHA256 9e27b302a5b7604f48642bffc38f4f4a1172bb13402b4ac514ab417fef8c8bf4
SHA512 c8e867c77a8cc3b7f6b647f62937fecbe2a3e8aafea70fa3ae128cdf8c645c3673076c6e45ebb3c8e852007f26d9e60eb278e65f6b526e359909110b02e697d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f11be44b17052f85697db0726f50e582
SHA1 ff974137b109e1449828e18b5fa665761ab52449
SHA256 190b0059bb84368c0ca18b90018acc541252321394139077545e2166dd262dc7
SHA512 42cda02a8655c0eed56c7f40c0dddab338457d894445e90240f66b7c0de6112734bf8a40bf4d15ee466d3042401e0c148eff6052beef9b5051b1e16b63604864

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0f4111f1a1ba0cf2620a835a1df4993f
SHA1 98d8debb0356c4666043a2d1f76af06c2b1867e7
SHA256 1ddaf534584c0ff288271fccd7cdd8b2011cedf74bad20cfc5ae6429348a335b
SHA512 3e6f472a81f027fa7f48c7c0da9bf4c169125b31193f21ea5668a556417acb11c209d00c52363bcf19c7a14cf85a09ed819ead932a06dd6767b55a22786a24e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9f5e398694fe901605e484fdb0c1cf40
SHA1 f6184449fcea753b250f26dc4c9df16cb6ce3bb7
SHA256 ed9f68d1ad4a8278755ffe5c5ff86a2383afc41c236e9ea8514024068de6603b
SHA512 95e84598ed553dadbb959ead9942288ffaeecde0069cc23187c91fc03a5a49f3d9132c2e678ee3d3658f0d966a941011ab9c873ab2a604439608f1aeb60c0f5f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 bb5e864529d2f666384aea501d02bdb1
SHA1 1a0e67a8a987d619c746029018209819ab3aac52
SHA256 67e1682a45a2af848590cf35eab08c7af8066589246b4319d434cc741210c88c
SHA512 2fc187319a5978fc7ffd30601fa938b996f44d548036bd892ef24eadfc429f679e6ac8d8102986b333f069eb540ca37136df58bcb35ad4c61085ee2b09523f83

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

MD5 c9d3ee64201f7543163d566741fa77d5
SHA1 c0fb7915860dc77c31d82f70dbdd1b4249eb3eef
SHA256 ee82facdab7c921a4423c60a6e998e4bba41f43ac6ed3273789a48f69b3327f0
SHA512 52f30859fa87c36714104269651a65ba1366247b0d326e1d41ee081cf66c3329a6cee561b4e23936d285b6fcc59017c78b6675244975b22228a89df955929fb1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 deb1e4d9cea73d04f42ea27fb66af99b
SHA1 8989d7596ccd6de3a68f93a6a5545a5768c95172
SHA256 672b1294a97ad4faaa999249cd8525e65f205c135e65428134bfe3c91aa07568
SHA512 9abf02fc3478dfd4aa1de4d3272c5fad1eb2040735663cfeea6fa7fe2fb37d1c363b17cce792378b91fedcdd7929eb8d207040852e5ac6b62fea75e75b98314d

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

267s

Max time network

278s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Mineshaft.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Mineshaft.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 52.111.229.19:443 tcp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

118s

Max time network

134s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\icon.png"

Signatures

Enumerates physical storage devices

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\icon.png"

Network

Country Destination Domain Proto
US 52.111.227.11:443 tcp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

92s

Max time network

195s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\session.lock"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\session.lock"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 52.111.229.19:443 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

210s

Max time network

305s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\villages_end.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\villages_end.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 52.111.227.11:443 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

244s

Max time network

256s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\villages_nether.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\villages_nether.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

270s

Max time network

285s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\villages.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\villages.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:09

Platform

win11-20240426-en

Max time kernel

91s

Max time network

203s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.-1.-1.mca"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.-1.-1.mca"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240426-en

Max time kernel

91s

Max time network

206s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\villages_nether.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\villages_nether.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

293s

Max time network

304s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\4f4a47de-6925-3ccc-a93f-d9c7ef283e06.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\4f4a47de-6925-3ccc-a93f-d9c7ef283e06.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

115s

Max time network

128s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\villages.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\villages.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
IE 52.111.236.22:443 tcp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

244s

Max time network

260s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\level.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\level.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 52.111.229.19:443 tcp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

132s

Max time network

145s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\playerdata\4f4a47de-6925-3ccc-a93f-d9c7ef283e06.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\playerdata\4f4a47de-6925-3ccc-a93f-d9c7ef283e06.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:09

Platform

win11-20240426-en

Max time kernel

91s

Max time network

203s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.0.-1.mca"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.0.-1.mca"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:08

Platform

win11-20240508-en

Max time kernel

241s

Max time network

257s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\stats\4f4a47de-6925-3ccc-a93f-d9c7ef283e06.json"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\stats\4f4a47de-6925-3ccc-a93f-d9c7ef283e06.json"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:09

Platform

win11-20240426-en

Max time kernel

91s

Max time network

207s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\Mineshaft.gz"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\data\Mineshaft.gz"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:09

Platform

win11-20240426-en

Max time kernel

90s

Max time network

193s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\level.dat_old

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\level.dat_old

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
NL 52.111.243.30:443 tcp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-10 13:03

Reported

2024-06-10 13:09

Platform

win11-20240419-en

Max time kernel

132s

Max time network

144s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.0.0.mca"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\§1§lMinecraft 1.9 Survival Let's Play S01\region\r.0.0.mca"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A