066d99b7eeae449af840cb0b3d84c516943309684021dd227b74e40918e31577

Resubmissions

01-07-2024 06:58

240701-hrjjaaydre 1

01-07-2024 05:24

01-07-2024 05:22

01-07-2024 05:15

01-07-2024 05:07

01-07-2024 04:55

Analysis

max time kernel
372s
max time network
383s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

490KB
MD5

901bff5e87be7b3c2c3ee45da179bce4
SHA1

2bd44512efd1923b5fd06b3fe2186e506d0f3d66
SHA256

066d99b7eeae449af840cb0b3d84c516943309684021dd227b74e40918e31577
SHA512

560265edf67899f2594bba5ba16f2243a4fa50f764df17eec7d09a753ca2f0eec2ac72c9d0d70e1bfe471b060fd7e16cfb6f4dfd0029866bf6f0d34be7b00697
SSDEEP

6144:VOxTA8eA8oA89A8iA81A8dA8ZA8SA8WA8NabK:VoA1A9AcABAEAAAqAxAnAhbK

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Program Files\Common Files\System\symsrv.dll	acprotect

Executes dropped EXE 2 IoCs

Processes:

WinNuke.98.exeFloxif.exe

pid process

4848 WinNuke.98.exe
2948 Floxif.exe
Loads dropped DLL 1 IoCs

Processes:

Floxif.exe

pid process

2948 Floxif.exe

pid	process
4848	WinNuke.98.exe
2948	Floxif.exe

pid	process
2948	Floxif.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2948-1516-0x0000000010000000-0x0000000010030000-memory.dmp	upx
C:\Program Files\Common Files\System\symsrv.dll	upx
behavioral1/memory/2948-1541-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2948-1558-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Floxif.exe

description ioc process

File opened (read-only) \??\e: Floxif.exe

description	ioc	process
File opened (read-only)	\??\e:	Floxif.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
1	raw.githubusercontent.com
18	camo.githubusercontent.com
60	raw.githubusercontent.com
80	raw.githubusercontent.com
96	raw.githubusercontent.com
109	raw.githubusercontent.com
110	raw.githubusercontent.com

Drops file in Program Files directory 1 IoCs

Processes:

Floxif.exe

description ioc process

File created C:\Program Files\Common Files\System\symsrv.dll Floxif.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{27AC801D-FB12-4171-9BAD-88D2EE4F8521}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{EE107BE4-7910-4DA5-BEE0-EEB41CE655BA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{05019571-8D8D-4762-87FF-358FF9882D29}	msedge.exe

NTFS ADS 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 175491.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\EA Cricket Installer.vbs:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 436139.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 823470.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 393256.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeFloxif.exe

pid	process
1804	msedge.exe
1804	msedge.exe
2784	msedge.exe
2784	msedge.exe
4016	msedge.exe
4016	msedge.exe
4380	msedge.exe
4380	msedge.exe
3788	identity_helper.exe
3788	identity_helper.exe
3484	msedge.exe
3484	msedge.exe
1680	msedge.exe
1680	msedge.exe
3180	msedge.exe
3180	msedge.exe
328	msedge.exe
328	msedge.exe
4548	msedge.exe
4548	msedge.exe
72	msedge.exe
72	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
3056	msedge.exe
3056	msedge.exe
3760	msedge.exe
3760	msedge.exe
484	msedge.exe
484	msedge.exe
3680	msedge.exe
3680	msedge.exe
1560	msedge.exe
1560	msedge.exe
3064	msedge.exe
3064	msedge.exe
1856	identity_helper.exe
1856	identity_helper.exe
3124	msedge.exe
3124	msedge.exe
3380	msedge.exe
3380	msedge.exe
2948	Floxif.exe
2948	Floxif.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msedge.exe

pid process

3680 msedge.exe

pid	process
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

pid	process
2784	msedge.exe
2784	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Floxif.exe

description pid process

Token: SeDebugPrivilege 2948 Floxif.exe

description	pid	process
Token: SeDebugPrivilege	2948	Floxif.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid	process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

pid	process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msedge.exe

pid process

3680 msedge.exe

pid	process
3680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2784 wrote to memory of 992	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 992	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4216	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 1804	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 1804	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe
PID 2784 wrote to memory of 4996	2784	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff860a73cb8,0x7ff860a73cc8,0x7ff860a73cd8
2⤵
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,8220559604791193114,1141591318333071774,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,8220559604791193114,1141591318333071774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,8220559604791193114,1141591318333071774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,8220559604791193114,1141591318333071774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,8220559604791193114,1141591318333071774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff860a73cb8,0x7ff860a73cc8,0x7ff860a73cd8
2⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
2⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
2⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
2⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
2⤵
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5464 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
2⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
2⤵
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
2⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
2⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,105879035992838179,1528316276924072658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2220

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\EA Cricket Installer.vbs"
1⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff860a73cb8,0x7ff860a73cc8,0x7ff860a73cd8
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:2
2⤵
PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
2⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
2⤵
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3852 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:72

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3300 /prefetch:8
2⤵
PID:660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3364 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
2⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
2⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
2⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6276 /prefetch:8
2⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1844,14979234643999050247,11042048251306034974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3760

C:\Users\Admin\Downloads\WinNuke.98.exe
"C:\Users\Admin\Downloads\WinNuke.98.exe"
2⤵
- Executes dropped EXE
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff860a73cb8,0x7ff860a73cc8,0x7ff860a73cd8
2⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
2⤵
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
2⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
2⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5056 /prefetch:8
2⤵
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5080 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
2⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
2⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
2⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
2⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
2⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
2⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6232 /prefetch:8
2⤵
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5328 /prefetch:8
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,8560243087094688386,17888652328700009607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6664 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3380

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de5e96508c63d0ab3f7317893e5c5a72

SHA1
7e669511fecbeddccf0b1b71c9465c3a0ddee08d

SHA256
4f27819c8d41465c8ebf99798e20048a7ef03f72dcf4220cf4a80f394266eee8

SHA512
21d60e7ea1f1ce83642480dd0aa9cff83c31d6cad5702d893e333797792553b62336a7f93da258cf5c07b43b28fde6d76e777551e480e2b87e33e9c637fe5aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6d802ede2944b26c3707372daef6ef21

SHA1
bce073d43701c643a6e804eec3b12231ad9be33a

SHA256
afe76edca99bc58670a8bb98f632cdc67406a62d04624fc90b8098bf5c7693c5

SHA512
4e1f824a74759a25182027076c7cf526aa1b51089a33cac3b55c5c544c82dbb281ccd9f9209f8d716048594da61a5436fe2690d19a5d4208a9ec72273618749a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb306c310da5e6c9293e088dcdf681b3

SHA1
0c8839eb639183a29b1b45826d5ecc72c664611a

SHA256
1a7f00f7ca95775214a5627f26a09761487c1305c71439a7b526962c1e1171b0

SHA512
a39b0b24ceeca57959e46a159da124b32f51931da7e1db5f2af3ae2866882eee995e578d521b74452449d15d8da5b261ff82aa698f48ad8063abec6a43714d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\483d87d2-bf2f-4afd-a647-6f8ce7adb836.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\889fc599-4c5c-4c9f-ad56-00dea1378d3e.tmp

Filesize
584B

MD5
c57e199aadb895d8951f6c013a164d89

SHA1
685f012fa56ef8560389dfe0131445c3939c4757

SHA256
2a5996e84cc5bb8317e5c6eaeeebf4f9672ee3a3e7dfc2753947f32b0a63455a

SHA512
5e39bb0197de4040268388cdf6d427ad8be67a37502950431bf285f33f4dbeef7efd19294b110bce1bca1d21321776e9b3a72323789f248044215cedaa4c8798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\980a7642-a611-408c-8624-d3e5c413431f.tmp

Filesize
5KB

MD5
4c5e9a6a2de8570388f78b3812539856

SHA1
1cfb74061949724d18d1ff06a1fd600e8ae056dd

SHA256
2479334050aa6d69508157fdb76f1b07c7f4b76083d71f9bca96466d1d2efc09

SHA512
fa663fe9ca57c5c7d4c549b473966a8f0a0eeb16528d315b6e165dc1c52bd5f3db635f51ac5eee537c862eb83ea5f702575d6f6ea444fa91a5d819185e2be4af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
436786641b44d39d4eebe081f74c35ac

SHA1
e5dad1f066b59f794564b4a929197010c4a1c1ef

SHA256
8925a2c8a4809936cec2c44e863995f1c7046905dbd49d2eb8edb660875be512

SHA512
1b83b03f2bddfe0d8d70742e9228356107a6a7fd48802501eca8e57b1777de86a5b413b058600e517eba29027634d01d84128a0c708c3efa99fc2105cfdaa57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
13b38138384dc761255def0a932d7984

SHA1
18689592649a1d2bd279fdaa6fd1fceff3a9cb1f

SHA256
122f50cf46c3b67f7abe56f6f396508379f2cabd75283ac6fdf80bd9a92ab9e0

SHA512
90bf707876a01e55ee78774d7bf7962e9fb34259886b6ac3f742ace03de3d34c739a2515454b32a6c90e487121caefcc5b904e94de33fd995efd3c843a3f4f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
26aeafae71109b66a8a7efda685331ae

SHA1
1f9fd00955a5ab47a4ca42d1257615f0fb84b28e

SHA256
b5fadb7c3891cfa7223a8c6b2bc03b54060d5078a73bcf4952180b942e278c82

SHA512
fd64b9f2f92dc08f85a005e33dd2902ac8c7fc614fb1abe02ad53590ee6e608d16715d51a80a2f5bd759c2972a0392a7f16a97fcd59674e2dba192df4ecc766f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
5f55b4cfa094fbe4b9c6b4548dab6a9a

SHA1
b8b0bef327174fd74ecd097901dde68909890eaf

SHA256
7a8e77e560b48c4a573d833db6763b738deaf33379541e0d2e91802c03ae8435

SHA512
1867548a5a833ce26d1094897f381586d9a5ce3495de253b22ef7887ffae5e46080bb3881513f2871b3ce9db135b9b336781f858f6a9124c34513c54a4a73cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
18KB

MD5
db1dbf2e171455089088500ae5e3ecbd

SHA1
05c968a749a9ebbaab726bc77d9021a984a5d68a

SHA256
3b60038b944a9b6be64c89b5b2042ccd5bd8dca00bc9cad9dc7d94a53f611847

SHA512
31b619290f910f3cea2be636cbbeaaa060f9b6d797edbdaa107393e73b08395a1677b272fb422e6be78eb26cecc16af42d999192c7c67d020d6eef54745dfb74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4b395c6751991e58f1b4cde50d5d8e91

SHA1
3219aa40dde7083025d0852b593a1fb0dd3bf6f8

SHA256
1190df2d801abfc7ecd54ad5c26417904b2d3f2858b4c40f99e77905f53f5697

SHA512
14ad55ff029de9243b5672fd32bfca428815537d77028737d858ab9ff814ac1a23b93f7349ad3e30f1f1c2ffc19d99c3b15499c2c89a1ae8075522e78de1ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
af85059a76a217be1bb5c6140a2380b8

SHA1
93e5b0bf339560b738880640cc01da72c21ebd8f

SHA256
1ecae8495f5f5c0a57d5fd8aa6e0fb1a35efdf59209ee4bd4f9b6ae29a8dce6f

SHA512
1e8818c20d19f3830f5abef9bad66a8a07069cd5eaba8360830bff1f0718b56891e18506f24c035190f2780b3e284b0db2b0df6ac4bc87c4c87ccc59dc7aa4db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
19dc4a7beb2e91f5414caf31661e2f0c

SHA1
8e8cf399d655f58846724a0deeb677bba66c69b4

SHA256
b1079a786f63800aab0570e7268ee505a1a70d7dd0c022f9ea6d8c6f0fef2e74

SHA512
01f009319d8caa7a73a298b970edae0c14611994ac8bbf45e3aeff7b836686e1851a0066c11c551499b72a00b70f4b3a671e44cdc3238c445178c66b91fe5619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
b4c4a79af068238c10406eabf9522f92

SHA1
a8863a6398b700f47391c38a55b6ccc7d6b6615b

SHA256
7b1792261ab50dbfe931d2031b690db265cab59015aff2f7445d499bcf7d2c37

SHA512
2ba9ea9a625979fecaae88fc96a90ebe7672f4e3e41ff05eac191bc439468c71d5e765e0704c8ee6d10820e8535a8ffcea95a8bcbcfdf4b0113ff4b611c98b95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
599B

MD5
578bc296586a3d8c7535eae48163f4d1

SHA1
d1b54c43e2749f7c7578fa003827c90a52b48d0e

SHA256
e10f506381412198f31e4310b29c4f6db4d620c62ca113dcb0f8f9d9e61e2d6a

SHA512
5f0430278d842e11eed8087e35b58fc79e3ce082321c07ab604a5d08170ceab559af3e8c467e4da523715b56784b2eab9d76a831a642ea28fe0f3b27ed654ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
44KB

MD5
c4697ef8f3a86629b026829f349818ee

SHA1
4c078dd073d58d6e44413b0b1487919456ccd4c7

SHA256
1aa43e3176090575ffd1a7e8fa2cd8c3455f89f3656920ecdee87701e61fd0da

SHA512
7938f138eb699d3e5192d53c01fe23a20c3e7ea19b8c6a654187b6d781fb201cbae1d464bd5742449dfe79836bf6dfc2197645f62a5cb5ea1e33ccd84f364465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
d1658f993c8d2c19d3a308b333f7b957

SHA1
16fe38ba57d8829e14d6d4ac0fd3370374ee3cdc

SHA256
25d81e589e673e0b9889580fa63fcfcc8a4bac2105339141da2e1a0bf522216d

SHA512
73863b013f7ca69ae7d8929f6d86119d0d2e874b6a691e6c00ce641b1779d296270a250d9f6992456919c89508adaeaefb2bfb543256fe01d7c56401c0c2a95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
732a382f8f0efe52a2c8521bb5664f97

SHA1
5706d6ce9c3784221444483cc9a404bcef860fbe

SHA256
a5fca06ebfb925d7aca5613bd545d6733cfb91df8dd48868b5dd2e35aab21d57

SHA512
f0a70dc692b7932e79433df3a05ac8e5bf424a3f16510161dbe5ddade13715f22a9458ea4ad4c5dde08872fde4f971d6555cc9949c1080193bb22bdaf425d5c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
50af8e631005969327075df6826e0c05

SHA1
086de8c04a5c795028ba1b5966db2c1095185357

SHA256
2f73965dd31e02e739a26757cefe98a4ac6fa85d800aca4fd7bba01dd5c12901

SHA512
475ec65fe4270a7ed08bd874782a3d40cdaa43098740580147b5e4e11ac3319c62ec1bcb7a20eb5e147936d7c0dbd80dc6da5d31669ad91c70f650f434883d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6f66bfba1736216978d7f5aa4bf1b058

SHA1
456c07a8ccbd4a4c3a93d4cac5451d99f8133085

SHA256
aca448bcacaa2540464b4cc6818656dd7694c4943325a37b40f2e1be0894099e

SHA512
ab311fa690ead8126e55628c930f0d4c0f83c289ccf6a3aad4f22d881d178d6bd994620d39665ea0f1f631153608a6333eb862cd8adc2a7db7c94516d8e9fcbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fed255670028e58b10613f35581338ee

SHA1
c94428e0d545c27c205d62027fc8320b4e2c0d0d

SHA256
76717f83aef8bcc774f1338b8a7888a51b769c4fe83f8c9a6b938dff0f595d9e

SHA512
b1eea96052c1f20f4c102f22917dd185d68e1cd7b1e21aa07b59165c9edc9e170b392c7dafdc9d98a349f2a5b76e09875634ef2623c448e45c68fa1f7322da37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23c02b8bd62c13e6f6b51924f143dbeb

SHA1
d304766e422e3431c981339060b71365605e85cc

SHA256
e0c86ecad8a7165d198c7350e243a32f1cf9262e145e3ef7467c8c008fba72a1

SHA512
4148980b69e3a85419833bed925970ed3002d7fb1aaffe0e315d49307f7a9cb32135f0dd9f43b7e138c69b15134d92c503fbd326857172ae7fbfaf4607f6fca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3a697d061194b271f667ad0e6e080648

SHA1
637470202ba286809fcecaa3f6c0fd824d94b916

SHA256
fa6b9d9445d4e818f6bcfd4ec91a5f2a0588e8c4303dca8e7de0e81a9c7bdc02

SHA512
67f3eae240ad807eba39277f966df52e0e41b9b1b16342eb91bdf0b3d3b80058e4d7c97e4307688f842d2c1df221cc8758c1d347b24249c808e929d8b5683836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
31a40290587e69e285d90d076c7165dd

SHA1
65e53de74205451b5d8e3565d7be06c786df1241

SHA256
6396ef116eb4355ceab33a94d0c0748854adeff6b224af60ec49345d53d3cefd

SHA512
4bbef9499d84e32f695868501f16ae60087267f011d1dd05d1ae875bb93370977a7579bec64b85fbe33bc243b3da18420b636a7c6916eb7010fc0978b7991489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7fd1abe5d57553108758d25bbce8b7d4

SHA1
ef78024e3f09fb6dee008b3bba5b9a03067e62fc

SHA256
8460f79e03e4d6bfa00891569714f25524dceec9752c587ee84ac28490a0ac2b

SHA512
421a94b0bfabf0eed8a5fa0522e657d045a233679acdc01baa6b0c0510016288ec31257588160820700c4f42aba1480c0ac846a37ad7cf6fd792d1189c2295eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1179a28e7e73c36d7c4e2873bb6c2e7f

SHA1
b40d321d85718e29bd3e813cb13abea1ba2f7598

SHA256
54a4394b39f4954cc499ce6b66ef1560f5d3b505934ee18f008c2d2fa5d6ed52

SHA512
e88fade4767ecd3cccbb10d9082b3b2acc7d02055957a61694315db3360e6ea5e5d26b1de085f96c95571c75073c1179ca33627df250b722fd5d5671871cfb47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ed11a17beb13337af48762d6b2db229

SHA1
c40426c997ab5aba9b68d5ebe7ae74a3042358d9

SHA256
7a964e7fef16ac3e79637397b7a2d13d1d11e0f475156eda6e170bab251dff26

SHA512
b06e8ceabbfba78ea1c42a079b294985740266e3140603d11a0e0eab05c93de601a4957d2493428344576d878ac18c15533cffaaf164fa89e988e42a832aaeb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85b893641f65b6895cd17a28e8907131

SHA1
79e27e4fa66a5f9d1a280b911bf257bc9716f69c

SHA256
3045f640fde87b603536442c5c3418f95509b3660fb62ae1560dbdaf62d9ebc4

SHA512
f38ddcb87094ee34cf699adf523dccc461e005de197a20c3dc435224fca9e4c264f8f3044067102d1081bfc68a3454da853be2eda923686e4030bbaba7a553e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ebab13e1c2be5f1004d105bb38dbd215

SHA1
697f24990c4e9d2d242312e34457e4f97dec2203

SHA256
a6e8ad54f4389dd413854f5922d91c72c43ba14d869fac02aa53b354bcfb8362

SHA512
94932b8c03c9c0d8a6327366a333a8db4e5f0855aac72595d476f5fab51b58a0e9838ea482bbb5337aab2f1d7b6ce04c22be86ef19d1d66279bbfb9d00520b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b5fb54639d7fd57dbfc754b214c75b85

SHA1
82eea58f8ea447063e2ceaa83fc97960cc997b0a

SHA256
a736e9ec406385525e4bce4f13c34fbfc2a4a2ad0528ef55454253375b542c81

SHA512
565cb243b0154665ba1e27d73dd336da128bf278c0768ae0a450f5ec4144e621661528aaec0e88fe0fd374f150ca47f7345413daf80237b89f260f9484638a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
48ec6cc232b29f5bce518a6b8ec2fbd0

SHA1
6dade9b9fc4e9b0d67803224572e2749ffee977b

SHA256
831769eb5bd048be61810ef2bcb63c2af7c5ecc197f4f72a088a1720e94322b7

SHA512
565a7396c62740c63efef476a2ac67eb88154b6bf22d07d22be6fe95ae370059c2bd446122f51b06c7439bcb1860149e6725c7d25e3f60fc0fe1d9ca119c909a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb654b8cb398455fd334fe7fcdb94244

SHA1
4425f7f54bdfefcc7d76ee9fbe80aa89dd582712

SHA256
b1ee9d1e26b829c30aa79cf73b9ace33316201d2265262e1305bf24d2f59d9f2

SHA512
e7cad65ea40c322f4e5afdc241c227990116ffc3d5e6b92b1a7476a8aa34674c1d2d26e45041e1bcb7273335e9e5411a187d45aba3a6193a74157e5d72077804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1546665451929698fb037308c51bbc2

SHA1
2b9d3262f0c73df920c27f6430e83936bfb5ae88

SHA256
ccf6371aa6f52e7da66266cee92c4c43facf2a82fb56d484686ba1b67cf77bb8

SHA512
26800ee4d5c4cb2cbd72839248363656645f9f3b982da8fd8840a4d1619ede0b2166d5ad1db0c5e350ed83b4b20daa5ebda1a4688d72d962e8fea6406cd568a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f3e768dae823e8609abe07cd9c77b1fd

SHA1
0a0c3963e2d2e7f1c3504185305e02dbaf45d0be

SHA256
2946491eb39cdd0a8b409e773a0101ec43f27093d2f944b23995fbdeb8014a2a

SHA512
460fd82e1eb854ef029cd3d4e5171d22c46b128b3117a97f040299895bc6eefa1c27104bbef8f574f093a7eb170872c4a0d2928edbe0b5fa984787c41fe52035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
465d55133532cd8ed48b2cd02a215b16

SHA1
ae7c4cfed259f25a17c48db613f1c4932db82fbb

SHA256
63955ebd77fdf2703e1589bddc783526ba12ba6b7c1cf39ae8495bf5142ae9a0

SHA512
3ff8eed098b1be0a36526600b959216dd4b7f7405c154724b7989c1f68d23481d3bf030474c44ea978574bde01be5dbef4bd892f7f6da2493e89c5dc0299c124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4ddb569830e89580cddab3b6a7c3ef81

SHA1
065d1318574bf7cd961e9193881ee51195190832

SHA256
88badd9b1a49357066331df8a174f85b0db0cfa8955d3768eaab783505025ecf

SHA512
b68d3dcb926f773e23350aa91f903cd3eefc028f492fdf5914e2a8ffe25c230bc58d2ff66f3cefa6c9a5e97e12313ad091dcda0e1210e6be2e35fb7ffc480d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
71e6240c20e93fb94cbaba2b5323823d

SHA1
c93235d2718e9adf6ef79a4da23f003dee2e4899

SHA256
29ce68c73bb4f236f74fe29ca7ca2099beaf1108967d77a1ee6237b5febb8431

SHA512
55f29f3b94ae7c1070398128165a8b71b9e42ff9efa7ce0d1564a403a3ac65b3c02762bfeab07524d2ea66601b9975929ff640420dc4ee2a860c8c8ed71f2b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
11a39719d981f0aab8577e9288de3caa

SHA1
3e3bb480724d47c6eb75fdd312539ce5aa712e94

SHA256
564d696818a2c8b305a96b4fde8750425b49942ff7b20ff929339a6ce3e87b13

SHA512
f162b05f6652eadb95ea6c5894720aca1bcbfaf3f3afaa8cf55f06523fb8ad797bee00777ac0c961bb1e5b6148fe94b45efa434674fb5143bc942642778c4a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL-journal

Filesize
28KB

MD5
d585cc66b4f710a74e11ddeabd069245

SHA1
26837e51ce5bd75b701c1bf0433270f419e9e46e

SHA256
928b7b1cd803bd5f189e19672852496f134614134a647533c67ced44d474bba4

SHA512
45169b937ab04a714a5af590ea08355df365d79a36d338aab8ea21214d1b71b2b56a3f2f39921636af5f41668683d2c119170f2974dca3638b4e02f52e0f7557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
327B

MD5
a66efaa590a0d16b1874a35836ba0a4b

SHA1
bb750c61e162420271f89a90f2b58f43587680e1

SHA256
b9ab1ed7609e2254b7d4fb655b57b21b2be601646c4ff0b207c411e8bdd9e654

SHA512
2b1ea0c798b69b360ab1546d14fccf7d5f9cb224b31bc8430cdb956c8cc570a086e4cfa10e6a843292deb862f4161dfc9b9abbc44afe397ff0ec9563646ff7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
49663ce9c461c118bd5eed6c7808fd43

SHA1
545cfe5ffd830ebf783f95192ff4aefc67f2dcb1

SHA256
9b85fbdf12cd73ceacfba7dd3c84c790c4a8e999f76845fc124050c8f07f00a9

SHA512
b8cc97498654694cb0d10eaf7805e57a3ba1f335541aed07c5597b6ddd56be22159640c36208c1fd5b262dfe0376133945e4dddf03696b95a57afd70e3422c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13364284082003908

Filesize
1KB

MD5
e8866e6dd046b6df8f12e6ef50b547b2

SHA1
0e7ff13f4af68ab123ea85d64631ea696d733274

SHA256
1136b55997e96da03f7ddd75fe1e327d96ef79b838a5d9b05f21b1123750f1a9

SHA512
c1e9f88056c182ad7f0d131052b66fb5ed0f084a483b19edea8a0e49c5fba977202f5313777c5f35408cc263dfe1dadaa4bfaf17253ec42e6ef2a82fcc2537d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13364284082298908

Filesize
1KB

MD5
05335fc43c92be25d711919ce1b049b8

SHA1
6611fbbc36012b35bc7bc202e954c20f7b380e57

SHA256
d576ae455594ea474f925cc4b0a367705fd5e2d7b0bed093ff70baf4935bfbfd

SHA512
c62400d9e145c993c2d9bc98972eddbebccc868c49a4134b924595285061b94f6e5af00c69cf6c42c090c482c404f9825bfe671ec5363f5ecc5ec84b5893ea8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
fe1992e2b2c86a14c391ff3a377f504c

SHA1
b3258fd7aade1e1bcac72dd2f13ead55f575f232

SHA256
e35bcad838a9a9f3d62353b535e7ee5185ed272dc9ae2e09025f61ba2afffa06

SHA512
8ecd6a248cfe34b4e141a01677fbd975a397f0aa744defcd0bb11375c2cc06db252d08847a6730db5ffb1ad887f65482a7b955997d31f64642534f38e1ccf664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
b495c5dac399be70ea87b520d54fc7ed

SHA1
922ca6e49cc242e24238cd1bbd9ce784452154d6

SHA256
fc040c3d98a3023d992296d4afc763e88340f087f7ab774b6b4fec9f45d99b1a

SHA512
558367d0a8580c3e40956016a321f56332838c3175b3110512a213fa2cf922d3ddafa8d9a41b52ef3a07d40cf12d97f7cc45ce241cb9256a5d9306d55b6ed382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3aaf7118c8d7e721af2bd63a88134ce5

SHA1
11d4c03b87f0c443422cdd0f7aaf38427d896308

SHA256
6ec3594f76a9511b9528812d2e69b3d8227f26d43fdc10da7a6093f85c640227

SHA512
ab005f3d816080994e2b2ee5e028c47847203833cde7db3b7cb48f88a4d8e3eb1e9d8029df76c5b56e96c6d2e664b470965b08513cb717b587cc0f0479f46e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff8f46207e240b0a776c41ab617ccae4

SHA1
e955abbf3955a83df89efbe196245c171593a97a

SHA256
a9c4e8b3c129d6db50acb13d74ec10e2f8ed55c757d9ebd5f2b884136f6e7011

SHA512
2c860049a77ed99282806f3e38e92577f978031c302b01028ff11b0462b576d14e1a69f6d8feeec06f473789f010b6c2fd48529b5ee7e769f497bed8a373d30e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1141278f192319f2b4cac069177b7b4

SHA1
3587c640a7f2309fcf8ef98ad0716b7b19eca8cb

SHA256
220fad1dcd3943bc113319de916b05485698fc965a31a2b41df32c7e977df776

SHA512
e4c86a8e51b8feaf0d4d7fc6c35678df078a13c749949ba6ffb1e6c67bc938e6e2420ffe8a52b342f1d8b1791f10627ef485a6892c30b5be185c7185b7d9428f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
06de65c855eac4f84a2d8e2cf6a3fc6d

SHA1
2de7f42c838092c5e0294a179d4d2ac4ccd084ef

SHA256
e0e4dff4362e4a8a95b95698b1203f7f6a7c0ab8ba5a9e69ca9c4f926bddba00

SHA512
d3f637e6ecad277fabdbfcdcb3be2cf37e752af932d5f130cef91e7ee6ffd59631ea20b35af9cb636bae6785ecf27caa8e0e1bb457c267ababb997eb500e6315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4ed0fad2be3396956510eac52011a6d5

SHA1
2846dab199872909911e60ed2a67da45bba35aa8

SHA256
44aa22f942f71ceefce1d6224d87dcf20fe0ca5ea5853a2d27c40badf1cd842f

SHA512
085d652ba885793aca04dc54b447fdc970908594bf5732d1e278a02c93c294313c98e5dd77a26300b60981e3588c537fd2d39e10417a59f7a9f2f76aed700ca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
452c651b2810808933adff3ed2e7db2d

SHA1
47e90203b6b20f06976ba230b144305892ee6a31

SHA256
d247085b42c35e99f1b7e1603d72020f67b2290bdd07a3e3509111e380fd83e3

SHA512
94f31afaf80c0e7e2c6c42a7e88183181774efc09f25f9a02628c2bc4dd0113878a088adb2aea0edb67236805361ae769599b570f0235ca7020101f6c96fd214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8e0bb9adf4c82ebb93191044aa6813c

SHA1
c21c391b0d2c8c8556d52c3e112c328891729870

SHA256
f8a21d2fe63020e1c200c1358249e2a9dd9a104e8a308f24c78a1d81973b3797

SHA512
692348dd01d8454345af8dd4ecbca27a8a138705f4e8970149f1c3f2127bffdf961cfe9a1310f58d6dad7c703a4d01488df689d8b223ef5f3c59d4268c16221f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f65ddd484a9a38353c2d1cda282017f2

SHA1
db57d95e262b169f37a6ba0bb782e4e3d7196854

SHA256
8dc814511e6637844b832c3911ebe28c92b5d323c2bc90dc8492fe54f4256a34

SHA512
b71fe8817c6412399bfd620d64c2919e8f8c0e809ea038dadf15e13569b36c6d02513d5f8bd7692a585687ff92f6113c5b4a8cb2b56a81e04e2d241a72ab7552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b7f234f2e3bdb9cef5f4a618d4937d1a

SHA1
a353fb7407ba96e1b8d7a5ec1d4d3362c5c3df41

SHA256
73bbd1c48c9ab0e869dd5d2c79a37d4703764d3851985906f142507e7df9d51f

SHA512
2affdf522bdb26f27878f6e9476a86c4079576c7a08a09ce68913d3e352b144033434c6de102ee2e73dc24c33b10d0697158fadf595341217b2a3ef5bf642baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b0a10c36031a3ee79f37a2986b158725

SHA1
60512d6941c06d59e85c2515693148b831ac4141

SHA256
ec6cb9a80c525d53e0f55872010b0dcba5d407fb38b43cc19e7e75e81d4cef3c

SHA512
abe5576b84ecc6bbcee92ba5eb04000dda0f95b08deb67cecff874e1f922fb7cdf76b865edc11e159219f1f933726f30d3c8120e68d0f962f1434a46b9ae1a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
35d80e617d1b390e13e4c962ddb5d49b

SHA1
557a966b991946311fbcef90fad93a0ecd8846cf

SHA256
9d24c09b22112bdf3d50cfd17a44f97f94743775560eed52375cded5c48b560b

SHA512
dada149dbba8c1b1810ea0f6e694cd5415c83b9e7ec4be70abc74eb16a99da50f3fe95ffd43c86ac9c5a1de8d9eaa1d237306406d1489aa169577c3cf483c26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
08cce5a22ac49c4145f9ba96fbdbeb85

SHA1
635cd4c076fa9884165731e7c332af02ce92c0a7

SHA256
f2dd0959aae79454e6e2545a0766ce860087dadf4425bdeffaec627b88caee73

SHA512
5ed45278d532faaf00ff43d618a8058dec6daab3c30c4f64ab5ef192fb08740138b0a6c6fb37523c5a80101ba6d4a8d71a032b21e76e171252dd95ef0e4bfa83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d2a.TMP

Filesize
538B

MD5
c02c67049b2ae5c96dcc84fb176f7ed7

SHA1
81b1c01f79455c0b3435fba845f00c42ae53e50f

SHA256
03f9f13666f4df2e92454ecc7691247e8c723ec1ae5cf159d397c5548a29df0d

SHA512
ba168071817398365fc34b532f83bbfceb5a95d2b1bf739f6c4c4857285c1d429c426cb485e3aca1f46a26c774759afc4e8e1a19896626ed05660f72496fe7bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
93e0b6a518f4dc15fb022420d9fc696d

SHA1
5d861b96b97b2c17459429e1edd15589c0aa6fba

SHA256
d54258ba7462f92446624a8b78c351f07bcb57db8bb0888a584d3a997f5637f0

SHA512
49fe4c97ca01d924e3be7c9d04e2c35cea359dab2bb7f41a54722da56fcbff71fb2486c549b5a65f7e2ec2180ef64cde44055aee484c02ac312ade55b7b1b6d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
568f1b66eb6898ff353d69af192f85ca

SHA1
2eec01070a58160d1cb3a6183bd0a1254dbe6a16

SHA256
50d5cbb482c7e2eb202fd8dcd313212711c6fe1774ab6358ba22f93f6a445d31

SHA512
2825eb93ef8bbe5b9f88bda18b2e108d74abc1ab6a2ee8bb6352b2e2f60c20f47768f4d4f04df344523eb89e5d8546223f315a33acc24ea1445d903a7c99c50d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
6466f12bf37a746cca6494896d773597

SHA1
10bf91a5ccf812d4c8a15b732b51ec87a7dbff34

SHA256
0bcee6f6c6933b9c9365a8cf18850f553e4f4b3a50e51ee33acb68d32ea65ebc

SHA512
ae7a1bf6b652419c0fd567e30aedce05e3e64f720a28ff1865f4b604d9168f73a844cf59f0cd03fa30cd7139521ba0cfdf434a741961084307d2832ec771101d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
c44cd0547fe6e65635536b668588aef4

SHA1
ad956ad4d6be2d975e39c89032ac3c54ba4845bd

SHA256
3408e09300bf7c1524368822f045593a4e3f9c4eecb072256d4a77cd1b71cc1e

SHA512
f23f49884e1550f512d91e0fbcc01af5ee9f1148d7c08fbe6580e2ba0fe1ab3f4797d6ae43ef7132deae87e0ff0cfd90046d12987f80f6e51b2dbd5acff7c00d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
b690c2416468d661e5594ec8d760e67d

SHA1
13b9c2ff19e34f65125123a5544e1d06d8cbb433

SHA256
4dc1de9948923e3610736da49bb2b38a7447ef8023180701f2156488435dd2a6

SHA512
a39e20e87645a0febb95018fed5ddbe636d2ed690268fec709237a95af3b9a839d694d0f566b91ae1160151f709f58dbf37eb22e0ce00c79231f10f8e21665c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a2081783217219dcc7b81d56d3b59397

SHA1
4d596d47569f926f2527d7ba390c1ca09e4311da

SHA256
74deeef01a284bc07cc469daed9b7974503dcba0b2fb52b6b1c2b1d1bcf3d2d7

SHA512
b0bc7450b935109f0dfa01f443bd5c4a0e41075c422bde5d70c233349ca3267c28813a1b30b5097058873f74e8ae954e792063f07dc55e6a0cef2327b6764a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
d2f556bc43588e3f0211c2fcd936c10f

SHA1
e17cc2316e76d111fb94228fcfefdbefb12e9091

SHA256
0ef23912d1ba671c7c919c2734fd32cf7c8c5a1cdcc8d4fa4e9bc95149f25be1

SHA512
455e23a53e2da49d322b9a4470fb69d38db733b7fe14037f1370f118910ed4102b2949d022e787f03e7c7fedd218ed74d84dcae8ede0b64f9de46ee3623757bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3371eabcd9ffacc4d3603d1a6a8e2a66

SHA1
0dc4d47fb6635f45e18bbee80a34e4a9781719e4

SHA256
9c17ec937be8502119f6c6932fdf142283a5b4d2df1be521c7abf7014cb4bddb

SHA512
02fdd6c053a85e67ebc714f633480cb1c10a589303e3d6ba333e6e13665bb40d9b89e52fdbd7d6f02a30ce3f5224f822ca9944f5c7b920134f09e91e78f559db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edee97d7671d9b406c012a9cf424b640

SHA1
b0386c5adfc585ca4d9b867eea92c3980945b291

SHA256
dff02fe76a2856a2bea38291dcaa790c23584e8cc7ebd5d12097991e309e7f2d

SHA512
9a290632adeb325b349cbb45e094d81e8996f044d18a42853d8344260b740e03f5ed375c8f4f405f6668670e3142946fc2f11fd23a09fdf7020ee038b6f4be43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
762f4e157af15ea923cb5b2d0dce8dff

SHA1
029f8a29a00aee04995cc83cf52c09a1269aa0fe

SHA256
7d4d6b226c4db035f1976a1fb69b6e2b2c37498f511644bb22bb079d1205b592

SHA512
ce38375cb3676318acbc9cbde2f6ca049dfce5249391a6009358c0085a5c9c3dd14b7d3fabfcdb6e84a4bdc55779340605e78d1a9b04b7d476ee836e68e68ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22070eeecba7df477687c0bda07285fe

SHA1
9d699905cffd411c96fc4fe7f8c8ed1abdf8b9fa

SHA256
b290993e3e9f4d9aaffc6d50b070f9180dac88e8cc6c5d1739ac29b4b646afd6

SHA512
cef853a07b4612247937aba63fd544eb80d3f0ac27de59ca83da04f6ccb7330ff455b1e492912237e3ad9908dbf8830d60a43992c871d0dce237c4bfe6f354cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41777a5261166b56336c2cc3a7f4e5ee

SHA1
6f09ec8f90ddfe8f5381b1b8975b250e51fab315

SHA256
ff9a3698ec194d46569e89d83f753adff800c3d51cdc35a4de39264673ffb4e8

SHA512
92a9729c59d997c567a0dc1aa8c77658eb7dc0abcd97a6a967f0ebd2ae6da50575b23238672ca0f6b1133d7e91ccfebe7ed58d2efeaad29c189477fd51e8384b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b020dafe0df7cb19945b252d56f6fdae

SHA1
300af78e1bb1eee375432459eb54e7a4a63711b8

SHA256
1a826a342329208fc77f69eefe2eecf642a75b1e0608dcb5d7ffd6dfa545dd8e

SHA512
103f841d7f91ae4e388053ba71e7881abd01add4fce34401472bdff7ed810fdc0835831ebf7a70f9a079b9b514441aa19b5ea2085f4a7238c8f5b30852977cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b288c850db353398b3dcc50f2af285f5

SHA1
423c2ae3514f8b87927bb7b899045cf825ee0d7e

SHA256
ab66ac1120a8ee57fb989bf59bbfe0363ef3e8d81c757d6d74a845c99a1982c2

SHA512
29b3cf560cd78e63c61e749b2e06f050132f14bff25d7c1587db68140e54082243fc35d7d10c7adcef90ec433ef1a140746e605aa70cf71fa72ee610e8520819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a7c7dd1ac079b694fe6b982ad78a531a

SHA1
990d75ea7f9e7f82c56fed08df2ea09516e5d212

SHA256
7b41ff501490407ca71f7d36d84151c8221bbab58b62a40851d7fc29e396ea8d

SHA512
0ba528d7cc315a581fbb122e1efdae8622c4e371a0c0a8ff1add2bfabf9b9df16dd3fe42b316cdc76deeb7e417c9ff359eed953d3e5cefa774b782cd1a2ee70c

Download Submit
C:\Users\Admin\Downloads\EA Cricket Installer.vbs:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 175491.crdownload

Filesize
1KB

MD5
bd6ce1d0a3264a74a5b0d7d99ac80b8c

SHA1
7552b50079f797c17c8c50a419bff3976a4113ab

SHA256
4797b445b3fc80669d8ce7fc1cbda24180b300bb555b8df8cde6197921df8e28

SHA512
de0d24ce51295d70984b805543a771697e1a67a2335ede4fb1c3b25a3783b2ed6c5464c8a6532e97fb08d48c639a77b1e460876c1e0a7aeeec40c0dd816644ae

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 393256.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 436139.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 823470.crdownload

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
\??\pipe\LOCAL\crashpad_2784_QHYZHFQWLRYFIUNA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2948-1516-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2948-1540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-1554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-1558-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2948-1541-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download