b5a74b2693a84d419701fa2272b437b194e2ebbd17837def5235b1aa7106c543

Resubmissions

05/08/2024, 22:57

240805-2xmbxaveng 8

05/08/2024, 22:54

240805-2vyxxs1ejl 8

05/08/2024, 22:48

240805-2rbcfs1cqm 8

Analysis

max time kernel
1197s
max time network
1205s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Octane.exe
Size

55KB
MD5

8aaa50737f6b341c4eab5c4974af917b
SHA1

c9d0261adf707026daa7c04000db07fe071f876a
SHA256

b5a74b2693a84d419701fa2272b437b194e2ebbd17837def5235b1aa7106c543
SHA512

a7a3b4c55a85c62a67719077633e5a60ad797168b7a09af938b5f0bf10b0a00689a5a73eb9048c11d508646c33deed95775f4e93e4f08d020f1b10c87feb5f9b
SSDEEP

768:FFqtcoRmBvd0SVFip0FBtiwyRWu+0HVc6K:6GoR2LhtifROMVcl

Score

8^/10

discovery evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1040	Octane.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1464	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Octane.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1432	taskkill.exe
4560	taskkill.exe
1276	taskkill.exe
2220	taskkill.exe
4832	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
3152	msedge.exe
3152	msedge.exe
2312	msedge.exe
2312	msedge.exe
1352	msedge.exe
1352	msedge.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe
1040	Octane.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	Octane.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	4560	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1040	1844	Octane.exe	79
PID 1844 wrote to memory of 1040	1844	Octane.exe	79
PID 1040 wrote to memory of 1420	1040	Octane.exe	81
PID 1040 wrote to memory of 1420	1040	Octane.exe	81
PID 1420 wrote to memory of 2220	1420	cmd.exe	82
PID 1420 wrote to memory of 2220	1420	cmd.exe	82
PID 1040 wrote to memory of 3952	1040	Octane.exe	83
PID 1040 wrote to memory of 3952	1040	Octane.exe	83
PID 3952 wrote to memory of 2312	3952	cmd.exe	85
PID 3952 wrote to memory of 2312	3952	cmd.exe	85
PID 1040 wrote to memory of 4920	1040	Octane.exe	86
PID 1040 wrote to memory of 4920	1040	Octane.exe	86
PID 4920 wrote to memory of 4832	4920	cmd.exe	88
PID 4920 wrote to memory of 4832	4920	cmd.exe	88
PID 2312 wrote to memory of 4668	2312	msedge.exe	90
PID 2312 wrote to memory of 4668	2312	msedge.exe	90
PID 1040 wrote to memory of 2116	1040	Octane.exe	91
PID 1040 wrote to memory of 2116	1040	Octane.exe	91
PID 2116 wrote to memory of 1464	2116	cmd.exe	92
PID 2116 wrote to memory of 1464	2116	cmd.exe	92
PID 1040 wrote to memory of 2356	1040	Octane.exe	93
PID 1040 wrote to memory of 2356	1040	Octane.exe	93
PID 2356 wrote to memory of 1432	2356	cmd.exe	94
PID 2356 wrote to memory of 1432	2356	cmd.exe	94
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95
PID 2312 wrote to memory of 860	2312	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\Octane.exe
"C:\Users\Admin\AppData\Local\Temp\Octane.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\Octane\Octane.exe
  "C:\Users\Admin\AppData\Local\Temp\Octane\Octane.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://octane.lol/keysystem/1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://octane.lol/keysystem/1
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffab19a3cb8,0x7ffab19a3cc8,0x7ffab19a3cd8
        5⤵
        
        PID:4668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1764 /prefetch:2
        5⤵
        
        PID:860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
        5⤵
        
        PID:2764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:4124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
        5⤵
        
        PID:4036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
        5⤵
        
        PID:3184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
        5⤵
        
        PID:4380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
        5⤵
        
        PID:2032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
        5⤵
        
        PID:1316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
        5⤵
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
        5⤵
        
        PID:3436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
        5⤵
        
        PID:3864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
        5⤵
        
        PID:4036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
        5⤵
        
        PID:4660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
        5⤵
        
        PID:2348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
        5⤵
        
        PID:2800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
        5⤵
        
        PID:4088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
        5⤵
        
        PID:3540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7332 /prefetch:1
        5⤵
        
        PID:2812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
        5⤵
        
        PID:5304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
        5⤵
        
        PID:5312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
        5⤵
        
        PID:5328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
        5⤵
        
        PID:5344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
        5⤵
        
        PID:5352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
        5⤵
        
        PID:5764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
        5⤵
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        
        PID:5848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
        5⤵
        
        PID:5916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
        5⤵
        
        PID:6060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
        5⤵
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
        5⤵
        
        PID:4732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9328 /prefetch:1
        5⤵
        
        PID:2240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:1
        5⤵
        
        PID:5292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9712 /prefetch:1
        5⤵
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9836 /prefetch:1
        5⤵
        
        PID:6132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10056 /prefetch:1
        5⤵
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
        5⤵
        
        PID:6208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9040 /prefetch:1
        5⤵
        
        PID:6280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
        5⤵
        
        PID:6320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10388 /prefetch:1
        5⤵
        
        PID:6388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10420 /prefetch:1
        5⤵
        
        PID:6456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
        5⤵
        
        PID:6584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10800 /prefetch:1
        5⤵
        
        PID:6652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10020 /prefetch:1
        5⤵
        
        PID:6720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11052 /prefetch:1
        5⤵
        
        PID:6788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9612 /prefetch:1
        5⤵
        
        PID:6960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11292 /prefetch:1
        5⤵
        
        PID:7064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8596 /prefetch:1
        5⤵
        
        PID:7144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5404 /prefetch:2
        5⤵
        
        PID:6192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
        5⤵
        
        PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9640 /prefetch:1
        5⤵
        
        PID:3520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
        5⤵
        
        PID:2268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
        5⤵
        
        PID:6168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2401197275725506885,11046651176737995923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:1
        5⤵
        
        PID:3556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\sc.exe
      sc stop HTTPDebuggerPro
      4⤵
      Launches sc.exe
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3904
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2396
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
66KB

MD5
b2015083e6a8e22deecda244105fee58

SHA1
2c70346ec41d3be8b06cff71f03c551081f451a1

SHA256
514b43f079b0faac2664c5a07c5da28afcf1dd27cdaaeca689aab661a7ef45bb

SHA512
73c5583b9f1bf0e07ffea184780b29d6e007ff2a78c7d217bb88159e1be2aa742e10d86d71cf877d1d0c93ab8b9c4bbb24c260eeac5225d950e9e87556e7c7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3335a9686006ef48_0

Filesize
229KB

MD5
0d25a33ee75c4feed3c878c4f02cb86c

SHA1
63ec9aaf81fffdb862cc76fb3be72e0983003406

SHA256
e3db7007cd519c1b0d4339b017e5d8c3084c7be7a073e70e795a299a656a7ed7

SHA512
70785afc2ca34dc471809a529ca4039c68ca3fbb1f87f495ef58c8ed4c32327eff4146adcd07bece11272ade653ca6d2adcb02681f52b86bd9b6e11b77342fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3cf8c3c98028fee0_0

Filesize
262B

MD5
f59f95ad4b1c1889a33ab8a905737c5b

SHA1
915017fc44fa68dd121a7f90c9d3ca13ab1255e9

SHA256
1fd79fd4719a940ecea07ceceacc5206a7d02d9506fa2681093cccbe0e952f08

SHA512
748b0ba150e0814281cf9665ce568ce9551858b4e02149786f291d2128d8a2c1eba2048a5039340c4972fec834b9352df9e41456caa2390337072f66dfe6e338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67b4d8b4fe869a67_0

Filesize
32KB

MD5
497bcee779e24b8d5bf48eacd0f4f11f

SHA1
ce9b7f755535a9d7c12536dbf3af6dc91bbfa7a7

SHA256
5256bfaf1c019b4626057109d9cbc097d9cbf9da58f06cda1149394ee8a8cbf9

SHA512
229ab588368ae6a9d83942788b88e6b428fcb64942c733a8c7a6adf91410b58929f78a4d95927adf2e59ced0cfb9ed13034d3731f4312e90ac2466b3e6f95831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f1748ad3f6c8123d_0

Filesize
218B

MD5
1e38c55b62cf86f714b2ad522409b289

SHA1
c038f033e8f98b3c28a78ecb397713e688a9ab7b

SHA256
35b9577b35cb76db933b2c36282a094cd66af626356a9e0d94c36823f9aa8993

SHA512
139480335c750fb147fc76908e2b17c289e5d0180d578fa13f4eee48ec92159fee0e74b39e2c8dcd0d22b491de2786123de230f1e06374df403c015a9cfcfe97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a65c8a40ffdb8225b1bf3621cb06e8dc

SHA1
ed21b608f768f50c8053d94cdf13379764e2cdb4

SHA256
a138e7055fab346db24c175166d7f4b5fd5138564499c9c0080c6a4ce09da739

SHA512
4c8fe9e8a6a2bd1e7e66b00e852f349994e66e39cb6885e6d3320ea667e026f283ca98524663b9e87348476ffbc786156142b92e055453d2c1d1d1ad3e43ff91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1017fe33ce0f2090a8048914227234af

SHA1
e8d51b57ae92ecfa15e98aa6c7b50ca1143503e8

SHA256
037fae24ee301351f633aaf550496b60231d34878d1f4d6202427a9d5d8157a3

SHA512
aecbb397c074d737b502eb3df42816ac6a665bbe4fc614932e4b60e5285973b566da341e1670b04a39f42cc12af19aaa49366c644470293a5dfeec91a6a3392a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f7e75d9da54072a1245bdf75752c25df

SHA1
3411799bb559170ccc5e3a81e9ac7b6203fcba0c

SHA256
31037a7d7efec6feededb72cdf60aa4161c2c5ef4943e506bb6df93ba532fa0f

SHA512
cc492639ff16141b0508bb5ce63c8501a76fb462382afd0d7db1816e7f1993d41d815951614ee16e4b7e33f28bc7857856677d9b17efb3f4e5cf8ed2bd4a90eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d8943247ae6e25337baedd7cceb2b901

SHA1
b0415c27be847bb26aaa0a1bd14fabf08b11227c

SHA256
5dc8ad3ef5359cef528451514bb58d8235cf7766a10da0e684b1ab8a7a52ccf1

SHA512
0be97a660f746f1f564f334476068eec960854274d75e6ddc2a5aeef1729a3d52509923b75aef51fed6979761926375e8aee949dafab019a796b84949c055998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
330180233ff967451b14d4b01eaa8472

SHA1
acc15966e1f862078ab42b2ddc0dff02f6817c24

SHA256
a20d88a95e5fcbb99adce95d8f90cafaf2ab785b86cfbbaccf6a67b5b7c03087

SHA512
4562c50278934a9eb1c6b632c63eb0ef42793cb454f111bed6f5e967ae4bf0bc60d2f22d8edf186e5fbe961387e65212135bcd734f349a5dffd0e8bda8a6ef88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bda15affefe92e6cf59f575c0b5f06e9

SHA1
fc0d03dc2cf94301994325b9514e66b63a1ffd12

SHA256
cd99ad1e88e0f9f8e1b85f5265eebc80644ec25743ef0426e7893d9b5c05d092

SHA512
50a57c16b432b4bb3d2a21b2e9e583907d1aef11babdee3cbab9e7219d013d67224daef01c293f27cda47fb75540b6435dac9b51f4b1264876838d2b92032c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0f190e5c2b2b467fa99fdbe1bb960da1

SHA1
a1807fc4cb276c39776aa4c047de14e1a7928e20

SHA256
3de4b3627f1b391ec75c9856081f77add9d84aea71570efb55b515001075d39e

SHA512
4b778178ace53ea85b57b4428b0fcff4ecea4c1b371687364d5c77f88a9655819092810aa74b3f461160bb234610e1f685e02454f624c6df8630df2b3bc51c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a32b9bcc41013b4bb25b1e9d68dab417

SHA1
8c2d989dd0667d4b16f986386edccc5e8d27b8c0

SHA256
71663069125a4a4e2982a30846d7ccd16a12f34e2a09adc2987dd0342b3e1a0a

SHA512
6efa389171c3a6b7100c18ce06bd52f616925510ddf858a73a2357b66150aa90d7ef0adaa178ff4ee553dde92d3238400dffe71b869e3bf9d36d798870a2093f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4473b1627261593bb1451f18cf70898f

SHA1
31d617913a5023a855e25046aea6514084b730fc

SHA256
2e59faaaa9a8f2463127a6802ceaa612a52aa5d8fb50ac21333112a88d8f63ce

SHA512
c951907a8f85738d57b2c117ba04fdd29bdebd71d727e9359deee100097908284550b8d5dc1b18dea86a6f368a4b839f702c89d093478c00fc5d7a508be2505c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
76ffdb491f5ad409d75aa5eba47e964d

SHA1
5420ca5497b112620a73014bad06173aae8f6b13

SHA256
fbf3cd53769568cb13ea17f140ae3ddf6c623ecb828015aad4c3913cdf8ede70

SHA512
cc6cfe603205dbaa2b12b188492fff423945177d411a43a07b8ed49e836651674fb9d6fe27683df5c29e002a92ff172c997e58fd8d2d1c2d877d585fbd13e536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7f7673679efb8e14cb8fdb80d9dab59a

SHA1
93dd66218688251a2931952d0a399f6dfe8cbd12

SHA256
42d68940c497456c5dc4500fe42c688cb8c0949223af2f6af6cac20645657890

SHA512
7606e06d56feb7d6c0a2f39c97319029911480c48dcdbd3db0d39a96b89c099e4e7427adb673de408d9f30f0d79d9149b762710150bb3b297a755ddeeda6d74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
883318cdfe545b16ec7094c37bbbd569

SHA1
6ef846225520609f0799db89795561d0e564dda0

SHA256
7dd2fa8f241a5dedcc03402a701a178ed1a539e0f40fa931fd2216220071fe79

SHA512
64baf35dedc0b3bbae871d7f34680556320a08310d1019344240dffb306d02b9a7f50bb2ba056fc8667c2e0f502c51643a0e39ee69eeeb1746af41a0b994ba4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a1661dd67d20baa362bd9039e4c6c6e7

SHA1
beec392773dbcddfbe92a5eedf158efb051cb4bf

SHA256
47b1637c5a432a81c9e831025972abc8947b687ee2296235701093285a5309fc

SHA512
0379265bfc0f0f501e1b17b13aae95b52e03f566289a78b8eb15a209f9c177caed6c822a00a3a0a8ad919290073dbc8273694bdcaddb12c261e9b3f0cab7713e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
eab3018d06132057e7bf9430535313af

SHA1
83eef2a6e3181aaa503a4793209bb6812b6c3aa2

SHA256
bb870f0861c36468da89de79555ffc0f132e27cbde7b17bc99e0dff4a24814ee

SHA512
6e2fab914228295b78d59f0b3dd8a8f77285fac133e8e175096502819aae5b0ed45c6dbea535c30a64da387369487c3d170e008ea12532c7edcde307035c1adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
a35a68e02173f4194cf3210c129441f1

SHA1
f01b47d2e9549c7d3414e9f7130413416f9aac55

SHA256
4a9c56b696059cafe6d2ea4923d3e173a77a3283b490120ae7c203d75f01b713

SHA512
551f9bb15879ca278088ecf231360d063bdcb25e77183844168759fc3459c88945fb690d1d70b6538628594d6c45f862538a530119d65cc88a405958909b777b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
3e9dffce842c5302e32243c2cf59240d

SHA1
f7663abddb4aec791d52ccde189de53c6fcbdb6d

SHA256
9d0883f385df6fded8d48e09009ddf962424c092b633f61d2c7e5b6ddbe8bdbc

SHA512
0daddc443ba97af8e1a125cf4b49c1db09eb6d4bc52fe74804c5abbe94a7814ae9e22461dd75a3243d6a01175cc69f24b145f24096ee2a23f5b381f8987d889d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
2856bb9401c9e9fe7b4a1ca53daefe98

SHA1
51974786273b64100110300d368c85b50b4faa50

SHA256
575e1163bfb6d84921c63193b3bbdba320df7621f91abf957297984a0f04b0bc

SHA512
6385b2b24abf1d31cfab41cc89267a78dc73e71a845331af231ada8e8a7394dfc751ce7b01791f76a38a068b531e410aae45d2e299a932532359d4544a6d824c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
0d7fff8e00ac63b5b451091e524e5e11

SHA1
24f08df21d33b45f383012e1a3e1d37798916dfe

SHA256
2d35eafa9007b1bd53baa2dd5eca62c8c6e3bfd1399d15ee43478fa2046139e0

SHA512
87121fe275ff60ead2d8dce4b1bd09998ffe71c5713b9e9021b6c1bbef2e6050a13f3aecf1e2ff3ff0d77c503944681a2af9d7da4bdfedbc02f8abc17a6d8bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d6c4bc394b3e2d9d68c8c5b8703c7370

SHA1
fa87adcf874831a7c49e8f7f2274530b88d5dd59

SHA256
98621828019c529331c05eca555a2b18466f7973e8e76b4928e8518fc1264aff

SHA512
4ba5a27b64605dac83481741153334ff21fc09300b5a5e71be7929ac58db158e2997430a31a7f34b876061f1b33a809e1eb4d6356780bc405d5bbff31bef0d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b7cd8ce9ffedec4a4c95299ef5788524

SHA1
2f89c45eeb5cc7eaffa1f10f76ef60b86c58ab65

SHA256
9430df9e0877693c748e2e2393f3f4bd019eadbb12d5233acbd0ccf7264718a0

SHA512
68141985ffb597540d01cff2a281d4585edba1bd9e0477724d4070ea80c76b15a7db761d18f5c27de6a3fac9009827b6c924ecea723e1435d4babbba7a360b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
06ae3e87f4f302bd1a53344bd6ea0c9b

SHA1
448038fe86bb564ab9d198688abd98dcb74954c6

SHA256
7bf0e6fd12cd409b91e94b40e227147b41089e7464608ff8aa0688ee768307df

SHA512
24e78b30cb93b0e7c3fce9426c4e6972f7c3645061508eaf6e644a2b7c98a563e58a800180f244e38e7e31ea8dd3304423598410d458794007b3707399fcb75b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
aecb72e883e4897e7a5f8204d04d2b86

SHA1
52f0e8c3ebb84eaf2db3b727a9bf67459f2ccd57

SHA256
f91de692ae809b00eda75129c7a1bc4ba9feba6aa8a43040a0dbc9c8bfcc7d06

SHA512
a14072c675ec03c6a41f73baac7e2d584e578d1624a420fdad532964a4a02e097c44b50fd66246e972595cd3aa2953066f940fe9a775dad338a9b665d1f91f11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582064.TMP

Filesize
48B

MD5
e02c7c6e3bc575d59e833f6eee6501bf

SHA1
b688af828b4cbf272c9b5fb1f860e23d43985101

SHA256
9705c55812d4b63aabccd837900525ed928f1ce15e1d6c02bf72feabd8daac46

SHA512
cb17d9b35cc562942b3c403a82a54ea3d80eeab1d807175e420a79723aa256a6f272d004f937d85b1d83a6a2667cf27d83394aa9875c92bdd9ad07a4b5669d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e0537d06e8f4bb3fbf8dafa78df7848c

SHA1
a5002440ac6448e88f0eed491bd98a4c67993569

SHA256
e637dc86d09356ec6c0d340e65b1c6ae9e46e337680e051f5c955c7e29908e3b

SHA512
c971b16ee52194c99b8560cabdd63308bfb545dfc15b51ea26a5377e2d135bee7786d62e9580c5600234a2e3a537af6c388c7d27f019049a1892009f68b8e309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cb2f1d2c11b196957c85696367a290e1

SHA1
f37ae5f64260198a953486cbd6eddf44677a2ccd

SHA256
63c37b6c44f0e04d0ce1bd0dca3a3f185f0407662829640573840a22519335b4

SHA512
cbdb1f33a46ecd3b8698ef7e79aebd08a1a978caad9bef715065b64835ec555ad725fc856612417c591ca16abf4bd2015f19b8cdfdbec79fa3f60204b046620b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f44d87414297d9dcc1a8f9cf180c43f0

SHA1
60d87e9d5b6d040b3c8b019a310f616ea5f65c2b

SHA256
0b81414bb3dc44366448ea50a56e2e2b07dccb12a10491b76f707c1da7ac281a

SHA512
930e7aeaeebd0a6808989ae04b26fd6f95935ca989b0fa34f1083b381f3f4584f9af20b7916f6df154187a907d393e5fe8b36410bc00d459fec233252d4d6bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bf33d1a138cd3bd3fb10d209ced03ab4

SHA1
157050eb430173a62cddfaa6185da1bd2616dbd1

SHA256
da0dd7e5df942aa10ac8faeca754f50c130c1a6e46214a8b2593b8de63225d0d

SHA512
725ea4d9700f5c583f6638ead954c9f538a7952fc88023584f29619ec2c7933635c4c3ce3b9dc2f432e6ea9c4ce534ebe56ffa705b3d185898eae145d957f99a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f98c84215f4e93574a9537801e652956

SHA1
477fca8b548439f167b48a213b20a38301dc93c2

SHA256
2f45e318f27fa9e74b728659bb0b06fadeddce9e955ac1b92716386377f24f06

SHA512
a4d71f3c6ef5d7c37d84e41e85df0209f01b8e6d775d2308b43b7d973f63d516902e7b5a1a3cb120a0a2537772e4150a8c89abc75b078354818c4b5885f30bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
31a3d8a58f5535b716628c586cea491d

SHA1
16fd96ac2c832b22e77cc4398a9ba6feacb4bbcc

SHA256
a4ef0ed8f92dea2100b1a8242d030f64caa66beee1f412119cdbc63c13dfc52a

SHA512
2b72724b0bbd47d70d37f203ae4440a6001fe507194a2c5c31aeec1300c47a9e99cb7c4a9298beb0f74bb72f80aa6d0ab00fd49f61c01a0f8e1b155f2539aee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
0dffbac872a246527fb28c15a22482c1

SHA1
aeb7bffcb38531255a0b9518b1818e575d932516

SHA256
d9bf79141b2b205eef7e214df85513d61a690af0b5179f26ea90fed17257543b

SHA512
15f641e0bb727ef719ee647d9aa2f23c442a4fb0e6143eaa822d6a374e03bb35689abf90799b4ef47bb464dba9b8d7b20402bcee79f6ffd2d89a6ecd04756589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ac28b3b950fb21b103a674b6c92513ca

SHA1
3a6df5a2e91a8275c47dfa5600fd8855295c758f

SHA256
928b3ed41b16b1a3dcfad2212b1de8e6021e2f6dc72fd72fcd39ffff0d3095e4

SHA512
fecee258c4b6043bd197274ac87644e31b71914c12f6db6f3166eef0adaf6c81b5339c681e856597322dce1500d6be79cd5d58a057cf13528108a5fd23083550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3b0b8d699d7ede9e58bc65ed09de6222

SHA1
20a77be4e23d37469c73a1ccb76c23e483b92440

SHA256
d2d6787c889374ae766b6c03ea340ecf3645b27d1fa5fbe0b2e879e3caf57269

SHA512
ed2327c8cb60982cdbeb257beb8d9fc02c88199e1080ee15c5a7deec2dd26c75717e3a49ed1f86ce01b1f1241765030c37d2b98422418dbab33f562e16384b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8ffcfe5d934b1cfd2ca80559e8c66aaa

SHA1
c2712a5adde7696ee6c06e8d6666a87ed59b4611

SHA256
5914073ae039f6a469cc7927eb314ada35aa5aa523a589904977828274cbd09b

SHA512
4adb0b2136be82ca1533dd4989129221f640558a34a138d4a15a2192a0fcca9d7ed0db11b7a7ed571b0e730c5d373399a40863489e1fbbc24f27bc1fa0d74a09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ac8aacfb4fb387086c1ed703f915b93c

SHA1
bf4a45cc1e2312849df538e9c64f4e9d37c2e5bd

SHA256
b671535344c32e430b65f1dfd466848756a750561a70ff6f2c01b49bd9f15e5e

SHA512
267dfcc8e7cd54ac3c4ba9a165d9e0c5ca2af5639ed91ad008d761749349fae1b18d4d52ccab80bfb516eac975459e2f21e1f6c0dfc138557e6af8fcf69c6732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
aa429a041dc29a073c37d25076c09a22

SHA1
fe4441e275a9da6a521494bfcbef29a0564aac95

SHA256
8c8669c730dd28fbea61ca26d340e8ac1193ecfcbee87d8b8ef1960ddce8e8ce

SHA512
21631581b71e28c94258e910cbb4b1210107fb9024fb23f16b266954a063628423f60c4cd008603b8b000b8891132c56d00a2a670e58e5ed7d4e78f7005c478b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
99ff09ea1c10477c6fcc3a2d7cfb74c2

SHA1
c2977fa8338fc1fb05434bb562107cb4b84246ec

SHA256
75d9dd25d8ede148c89083123b4064c6147bdd938af524b7ec10763c86ed4cf6

SHA512
0dd3c15ba472502a54ffd9ac1956cc208a192ec3fe90c29283a90ece2bfd7327a63cad4a7084bfe5ba0adcd95f246d341eb5dee34cc114cfaa6a045961b52ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c8874a2a81aedf10dba2ada683ba80a3

SHA1
104d71458cb3f2575523830453f8e7a9f2b5da0d

SHA256
0e6b99b593e112fcf4d564a799a0b4d5f9c89422dd54d6f96aeecc57bfd534d7

SHA512
b033c69cb8dc44a7807f452d82f4083309d14d27a3be5f4f72291ba4eda74ac65e96f1bd2615c292f47636f9bd886d4e0003761ed21852619f1ab744b34f5ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0231d593b4d950e9ba1c51e2ee7fa3c1

SHA1
3914a74bca972aa79daf7b665c5f8d8a93f0372c

SHA256
2067a48ab0f1185d3710cdf35ab0c160fbea71bb7bb79d551e6be39b516aeaef

SHA512
814aeda34dae6aeb7d0a96756597e9538fd78862bf4c3fd1fc08bb1e8dd8969e778d448d5cf1dc15230b002da6373e297179277d8d30ef22588cb73e490ad9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fecde8545f24dce55c9f800dd385b4ca

SHA1
dbf2b55503b90d87c8a7d134a7e251acd0731f71

SHA256
8972cb30f73f9a93bd1bce7d5df4c0c6b0856b30cb217c41cb86c34493fb64ad

SHA512
b1f0a58c0652427b01a7c193ffe43b2b5a6ae773ed68176042fd776d261e80d50dc1980cd4d8009b4789b8f3f3c73e0ddee6368de504b3aa74e782a0060d794b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
04f5cfbaa9f3a644f54a835a632e8bac

SHA1
d4bbfc478141682748bc91abfd4fadc8070277d7

SHA256
aacd77da8b2bcb7b430f2f35b8448db33bb9b26ea5dc3d2b42de287b8625ad89

SHA512
41e35d628326ec3d7ca338a31202df4eda2b67d85571c4b6fc0ccb1b9525c5a609abc86d7a6a120e7157e372814b1d5972fbb712bfa1b12e9e83fbb524e1aaa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f15e0c604db89e8f0ed4cea62b5e563c

SHA1
e5b201c87c4b93b982e0ce553a68beb784d1032d

SHA256
6ac1d50020f3fb16530561ef0cbec28f47194c021eecb749430062a8880a59fd

SHA512
ab770de8ad5bd7264ddd0a2ef461a28e41f2eb01942da58e4776a08c44b24c8541e7b24c66e9deca7064ce40c3197fb8aeb3fc53603f9a972e279ef15282777b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2e7df57e855107a2a81e8de89139986c

SHA1
562eb02ceee9946ea58938e5eebbd1bb7ddfd04c

SHA256
bfbb6b2ef14ae0a569b128a9957dc5af535b089ff14f32c134db77c8673154b1

SHA512
0aae16de535588c91e3e40331d39e1a2e4b2af37527fde8597698f89b5bc85599a71531c2dc9cee18cc8931e419667fe199a37ce8bad3fe9c94f79d4631664ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
80c152c89a59a180ef7c94be18dd199f

SHA1
ce60364052a157896a42b6a6331ec1afe887f449

SHA256
4257aabd22d95f9f1de7f4b06dee3ee0b0891ae03c28e9b4a00100aa84c3a36e

SHA512
e77ea22673679286e297f56ee5f399e7e1ad35891b946e74baf6b99a4dce10df28013a02e4904b4e4300d58fd8c786bc3b14601a7d5887e1a5d4fadf2ef5a9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9a80bb25ee8d3ad44168bac9bf8fa0ab

SHA1
56a1f980b072865bc13b66997158cae922fb67e0

SHA256
a79c99bd8f6b2cafc22f778da9240f6c99061277acc122161aa6009b7c2592c8

SHA512
72a9ee5cde5c7b20ae1fe4615ceb9f48005f4f36f0189b35ee1ee1db629f9dd8ca9f191e4c36b8cbc3866c4f0f35e646d2b1ebc976bd90f07730864827b4a078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58073e.TMP

Filesize
1KB

MD5
997b6c90dd9f7a2586bc9919b9656171

SHA1
15f483eff139157a8e037783467cd94e831b061d

SHA256
11ecb5dea07599a1cbf55d1b6ff239315b1ec688cb2a6982483bccaca6101032

SHA512
7ff9fcc679ca1f24c00cd51375318f0d0864157c5e997553f55d8baf92376445a7f5990fff56644a02e93a938e32a38f165ef52e23cc5a8bf0c72746c890f85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd1398210273d9d179db14a27521a902

SHA1
46bcd236b6d017e2b7f033cb9d8620a1f259a78f

SHA256
7cef3af91e167efd4638159536a163db7e45272fc7e15554a476c5fd8f2eb15f

SHA512
14bb5de4d9f141644b5b56c1e56e016625c760e502ae1ab97d01ea96a245afabaa8507147a9416363a821283f47154ff61d36f3548fdf168cc2bd64464586f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
363443946ac0a4269b76219c08e973d6

SHA1
2e066394ed3b54b7c4d9516775eff9636631032f

SHA256
bd9f1b8895aad759d66c0a4dae3f32a6189fed242929675abb23d7aa7fd38ceb

SHA512
3ae77bbe350a6f4d05cd096514f0c6ba6bdc9490ed1620e195b70782555032283c1a4a789d3f4dba6562e02b530c8c4471680274267da49f018d0d287ab78c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Octane\Octane.exe

Filesize
1.7MB

MD5
d02263c63eccd063a0387e56aff27e8b

SHA1
d4e2a58a4a8ea06d88a57f5f5206c6d2a8d97727

SHA256
baf99c993a1094965c7bf688b525f76a0cfa21848839ed58050c8f35f5c7ddb4

SHA512
dc7614dcb134c8fa6840c0f1af6fc2b4d3b762a6aafd5c388731b6c7b5636c6912b3a0391e08c397870bddf753868975091478e44d89ebb49bb72175a534b345

Download Submit
memory/1844-5-0x0000000009210000-0x0000000009248000-memory.dmp

Filesize
224KB

Download
memory/1844-6-0x00000000091D0000-0x00000000091DE000-memory.dmp

Filesize
56KB

Download
memory/1844-7-0x00000000749C0000-0x0000000075171000-memory.dmp

Filesize
7.7MB

Download
memory/1844-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

Filesize
4KB

Download
memory/1844-4-0x0000000008F70000-0x0000000008F78000-memory.dmp

Filesize
32KB

Download
memory/1844-25-0x00000000749C0000-0x0000000075171000-memory.dmp

Filesize
7.7MB

Download
memory/1844-3-0x00000000749C0000-0x0000000075171000-memory.dmp

Filesize
7.7MB

Download
memory/1844-8-0x000000000AC90000-0x000000000AC9A000-memory.dmp

Filesize
40KB

Download
memory/1844-2-0x00000000749C0000-0x0000000075171000-memory.dmp

Filesize
7.7MB

Download
memory/1844-10-0x000000000A0B0000-0x000000000A0C2000-memory.dmp

Filesize
72KB

Download
memory/1844-1-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download