bazarbackdoor | 8ef176944e54df85db028979ceb66b2b6e807b1615f4254c273d4b433caec0dd

max time kernel
280s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dl2.exe
Size

849KB
MD5

c2055b7fbaa041d9f68b9d5df9b45edd
SHA1

e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06
SHA256

342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3
SHA512

18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc
SSDEEP

12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2

Score

10^/10

bazarbackdoor backdoor discovery

Malware Config

Signatures

BazarBackdoor 64 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

backdoor bazarbackdoor

description	flow	ioc	Process
	448	zirabuo.bazar	Process not Found
	431	zirabuo.bazar	Process not Found
	435	zirabuo.bazar	Process not Found
	455	zirabuo.bazar	Process not Found
	480	zirabuo.bazar	Process not Found
	495	zirabuo.bazar	Process not Found
	483	zirabuo.bazar	Process not Found
	500	zirabuo.bazar	Process not Found
	447	zirabuo.bazar	Process not Found
	458	zirabuo.bazar	Process not Found
	466	zirabuo.bazar	Process not Found
	473	zirabuo.bazar	Process not Found
	482	zirabuo.bazar	Process not Found
	496	zirabuo.bazar	Process not Found
	497	zirabuo.bazar	Process not Found
	450	zirabuo.bazar	Process not Found
	492	zirabuo.bazar	Process not Found
	493	zirabuo.bazar	Process not Found
	499	zirabuo.bazar	Process not Found
	443	zirabuo.bazar	Process not Found
	444	zirabuo.bazar	Process not Found
	464	zirabuo.bazar	Process not Found
	479	zirabuo.bazar	Process not Found
	442	zirabuo.bazar	Process not Found
	446	zirabuo.bazar	Process not Found
	476	zirabuo.bazar	Process not Found
	491	zirabuo.bazar	Process not Found
	477	zirabuo.bazar	Process not Found
	437	zirabuo.bazar	Process not Found
	440	zirabuo.bazar	Process not Found
	459	zirabuo.bazar	Process not Found
	463	zirabuo.bazar	Process not Found
	468	zirabuo.bazar	Process not Found
	470	zirabuo.bazar	Process not Found
	474	zirabuo.bazar	Process not Found
	487	zirabuo.bazar	Process not Found
	494	zirabuo.bazar	Process not Found
	436	zirabuo.bazar	Process not Found
	439	zirabuo.bazar	Process not Found
	467	zirabuo.bazar	Process not Found
	488	zirabuo.bazar	Process not Found
	438	zirabuo.bazar	Process not Found
	441	zirabuo.bazar	Process not Found
	449	zirabuo.bazar	Process not Found
	451	zirabuo.bazar	Process not Found
	461	zirabuo.bazar	Process not Found
	465	zirabuo.bazar	Process not Found
	432	zirabuo.bazar	Process not Found
	484	zirabuo.bazar	Process not Found
	485	zirabuo.bazar	Process not Found
	489	zirabuo.bazar	Process not Found
	501	zirabuo.bazar	Process not Found
	454	zirabuo.bazar	Process not Found
	460	zirabuo.bazar	Process not Found
	471	zirabuo.bazar	Process not Found
	481	zirabuo.bazar	Process not Found
	486	zirabuo.bazar	Process not Found
	452	zirabuo.bazar	Process not Found
	478	zirabuo.bazar	Process not Found
Key created		\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe
	453	zirabuo.bazar	Process not Found
	472	zirabuo.bazar	Process not Found
	498	zirabuo.bazar	Process not Found
	502	zirabuo.bazar	Process not Found

Downloads MZ/PE file

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

flow	ioc
446	zirabuo.bazar
461	zirabuo.bazar
490	zirabuo.bazar
492	zirabuo.bazar
458	zirabuo.bazar
491	zirabuo.bazar
499	zirabuo.bazar
437	zirabuo.bazar
462	zirabuo.bazar
482	zirabuo.bazar
484	zirabuo.bazar
447	zirabuo.bazar
500	zirabuo.bazar
501	zirabuo.bazar
497	zirabuo.bazar
436	zirabuo.bazar
449	zirabuo.bazar
452	zirabuo.bazar
472	zirabuo.bazar
483	zirabuo.bazar
486	zirabuo.bazar
438	zirabuo.bazar
443	zirabuo.bazar
457	zirabuo.bazar
463	zirabuo.bazar
487	zirabuo.bazar
440	zirabuo.bazar
473	zirabuo.bazar
474	zirabuo.bazar
489	zirabuo.bazar
493	zirabuo.bazar
481	zirabuo.bazar
498	zirabuo.bazar
439	zirabuo.bazar
448	zirabuo.bazar
450	zirabuo.bazar
478	zirabuo.bazar
479	zirabuo.bazar
480	zirabuo.bazar
442	zirabuo.bazar
455	zirabuo.bazar
467	zirabuo.bazar
469	zirabuo.bazar
459	zirabuo.bazar
475	zirabuo.bazar
488	zirabuo.bazar
502	zirabuo.bazar
432	zirabuo.bazar
444	zirabuo.bazar
476	zirabuo.bazar
453	zirabuo.bazar
485	zirabuo.bazar
494	zirabuo.bazar
496	zirabuo.bazar
435	zirabuo.bazar
445	zirabuo.bazar
471	zirabuo.bazar
441	zirabuo.bazar
456	zirabuo.bazar
464	zirabuo.bazar
495	zirabuo.bazar
431	zirabuo.bazar
451	zirabuo.bazar
454	zirabuo.bazar

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	104.37.195.178
Destination IP	51.255.48.78
Destination IP	198.251.90.143
Destination IP	158.69.160.164
Destination IP	193.183.98.66
Destination IP	172.104.136.243
Destination IP	107.172.42.186
Destination IP	51.255.211.146
Destination IP	163.53.248.170
Destination IP	63.231.92.27
Destination IP	185.164.136.225
Destination IP	45.63.124.65
Destination IP	82.196.9.45
Destination IP	192.52.166.110
Destination IP	185.121.177.177
Destination IP	51.254.25.115
Destination IP	104.37.195.178
Destination IP	158.69.160.164
Destination IP	45.32.160.206
Destination IP	82.141.39.32
Destination IP	193.183.98.66
Destination IP	92.222.97.145
Destination IP	212.24.98.54
Destination IP	89.18.27.167
Destination IP	130.255.78.223
Destination IP	45.32.160.206
Destination IP	63.231.92.27
Destination IP	139.99.96.146
Destination IP	91.217.137.37
Destination IP	167.99.153.82
Destination IP	94.177.171.127
Destination IP	139.99.96.146
Destination IP	35.196.105.24
Destination IP	91.217.137.37
Destination IP	81.2.241.148
Destination IP	35.196.105.24
Destination IP	51.255.211.146
Destination IP	91.217.137.37
Destination IP	77.73.68.161
Destination IP	51.254.25.115
Destination IP	142.4.204.111
Destination IP	142.4.204.111
Destination IP	159.89.249.249
Destination IP	87.98.175.85
Destination IP	45.63.124.65
Destination IP	35.196.105.24
Destination IP	176.126.70.119
Destination IP	111.67.20.8
Destination IP	142.4.205.47
Destination IP	188.165.200.156
Destination IP	82.196.9.45
Destination IP	63.231.92.27
Destination IP	147.135.185.78
Destination IP	46.101.70.183
Destination IP	66.70.211.246
Destination IP	144.76.133.38
Destination IP	147.135.185.78
Destination IP	96.47.228.108
Destination IP	185.164.136.225
Destination IP	35.196.105.24
Destination IP	163.172.185.51
Destination IP	158.69.160.164
Destination IP	51.255.211.146
Destination IP	192.99.85.244

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{9D094487-4A91-4851-960B-3E37C7D46113}	msedge.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
644	identity_helper.exe
644	identity_helper.exe
5980	msedge.exe
5980	msedge.exe
2172	msedge.exe
2172	msedge.exe
5652	msedge.exe
5652	msedge.exe
3952	msedge.exe
3952	msedge.exe
5220	msedge.exe
5220	msedge.exe
5356	msedge.exe
5356	msedge.exe
5356	msedge.exe
5356	msedge.exe
1704	msedge.exe
1704	msedge.exe
4484	msedge.exe
4484	msedge.exe
5296	msedge.exe
5296	msedge.exe
2912	msedge.exe
2912	msedge.exe
2424	msedge.exe
2424	msedge.exe
2980	msedge.exe
2980	msedge.exe
4768	msedge.exe
4768	msedge.exe
1704	msedge.exe
1704	msedge.exe
4760	msedge.exe
4760	msedge.exe
2228	msedge.exe
2228	msedge.exe
4604	msedge.exe
4604	msedge.exe
4396	msedge.exe
4396	msedge.exe
852	msedge.exe
852	msedge.exe
5508	msedge.exe
5508	msedge.exe
5860	msedge.exe
5860	msedge.exe
5936	msedge.exe
5936	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3828	dl2.exe
5032	dl2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 2844	4244	msedge.exe	96
PID 4244 wrote to memory of 2844	4244	msedge.exe	96
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 2004	4244	msedge.exe	97
PID 4244 wrote to memory of 3840	4244	msedge.exe	98
PID 4244 wrote to memory of 3840	4244	msedge.exe	98
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99
PID 4244 wrote to memory of 3032	4244	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\dl2.exe
"C:\Users\Admin\AppData\Local\Temp\dl2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3828

C:\Users\Admin\AppData\Local\Temp\dl2.exe
C:\Users\Admin\AppData\Local\Temp\dl2.exe {E6766908-B85F-4ADC-9687-9483528C4738}
1⤵
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- BazarBackdoor
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdbdca46f8,0x7ffdbdca4708,0x7ffdbdca4718
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1372 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7936 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8660 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8516 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7700 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13061200644626628117,13886713890666242280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7876 /prefetch:8
  2⤵
  PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\120307a0-1ddf-4e48-ac53-f6b53fbc4e48.tmp

Filesize
11KB

MD5
94c1249669621ea91e3d09677676244c

SHA1
3e5386db340db2e4d57b262bd98e6574c1ccf7e1

SHA256
73b02357d1310446b3200d404f23873016dc286964b63a2b775bc24dd8d009ad

SHA512
3e2d35e4d7bd7e0130c1855652dff5a90bc59badbd30538102f3aa2601225966b4835d579da7e85a6d113eae8cfdb9cd1f309419af5d3d554af9aeefb0e2792b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19f49eb5-8d92-48ff-b0fe-69f970ffc5dc.tmp

Filesize
10KB

MD5
fe870b31a69ec21fc6c1f821b5df7955

SHA1
4f4535e8f07aa22aec27ea59f91663c3f0426e52

SHA256
639a9dd598dd6cefeedae34840ce2ec6a6e48e0b15dc22f9bc920e3dba5e2503

SHA512
47e8e2d0d5075ca4dd5d8bcfd40f0632601ee1321e4e2abb76ae76e117520f8caa22dde4942ee9ff52cf40a2b9588ba66d5e4bf1599ef2e93623924cccb23506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
a7ee007fb008c17e73216d0d69e254e8

SHA1
160d970e6a8271b0907c50268146a28b5918c05e

SHA256
414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346

SHA512
669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
9f8f80ca4d9435d66dd761fbb0753642

SHA1
5f187d02303fd9044b9e7c74e0c02fe8e6a646b7

SHA256
ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359

SHA512
9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
73KB

MD5
cf604c923aae437f0acb62820b25d0fd

SHA1
84db753fe8494a397246ccd18b3bb47a6830bc98

SHA256
e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4

SHA512
754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
27KB

MD5
c3bd38af3c74a1efb0a240bf69a7c700

SHA1
7e4b80264179518c362bef5aa3d3a0eab00edccd

SHA256
1151160e75f88cbc8fe3ada9125cc2822abc1386c0eab7a1d5465cfd004522c8

SHA512
41a2852c8a38700cf4b38697f3a6cde3216c50b7ed23d80e16dea7f5700e074f08a52a10ba48d17111bb164c0a613732548fe65648658b52db882cacb87b9e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
1.7MB

MD5
d089cb9cb35bfc62d1fa9e971fac6ca9

SHA1
8085986b8e6c22ccb5035350931df07180d139ac

SHA256
9e6a0b7938a1aee5ea1bdd264a1edf0b66a2148baafaa94b9e6dcca80b63a5ba

SHA512
c27fc96ec2adcfbf26cc7f1320f0ab23330d2f18c9865ad9c7a5757d0f3d35e7c649b9c2cb41726c267d700b805421f8a122e15b589c70b6c9099cde1cbad796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
30KB

MD5
879a4377f9e417a29815b6ab478d2f22

SHA1
b1fb7d22f79df1f2bf8c0e8d6065fb6fc1cf33db

SHA256
ae00c9173e586ecb200caf81c7c3994e5865989569bbf2e63e9cdc0d107850ee

SHA512
e6c7314ca86b94ba31295d94e7233fa496d731756af93f2368078bc703c6f7184efbf9b2e9e0b21e586b3434e62226c35668a146391bea0f99be8db1e5986995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
24KB

MD5
393c299e47c19be05aedcd791517a68c

SHA1
aa99e53e61c241ac15cb261ed804e0bc6cb8938e

SHA256
a5208d79a8ac97ea138eff1f5b7a891da746832266953833e91d811127036d56

SHA512
b72944b87a89a1768439f403a77c978aab86c61ec493c6fc55cbe1208a9cde0152e50931950b09d715d3ddbf77e267e583f99e0a0bf72b924846ffd92f55d1cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
30KB

MD5
888c5fa4504182a0224b264a1fda0e73

SHA1
65f058a7dead59a8063362241865526eb0148f16

SHA256
7d757e510b1f0c4d44fd98cc0121da8ca4f44793f8583debdef300fb1dbd3715

SHA512
1c165b9cf4687ff94a73f53624f00da24c5452a32c72f8f75257a7501bd450bff1becdc959c9c7536059e93eb87f2c022e313f145a41175e0b8663274ae6cc36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ebc5d2125a0d76254e3507c3735606ef

SHA1
b98425c2c62d793820e41378327a81a27d343cbd

SHA256
447ae6b3f644927d5a393d50d6ac7aefa8ebdc6cd7de64f14bcc400f560f30c9

SHA512
64ab864756b3ddf2afa5c8c02301005061d86c8b04db466f81cacecd2b656ebe7e958a6aa3c32ec04ec8d788d83ec59fc56fd8305a4496b3840559851fc7ed2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c0e3be524162d3cb8b1cee55b7c4b06e

SHA1
eccfc398b858b080c6fa8e57913d0378b44d2dc8

SHA256
931b8722fd7c949d03963bbcc34089dc8facc204ef83e9d3a1ddbbe2b1c52559

SHA512
902d852f93e560be5c1faeb0429d4b1942917fa0f0da453c5203deb2732936c7ac258ad158f6d3c09a79465a3f8126746bc68022957243a79c5e7dbb97cc0b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e4177bae96232a5e4aaffef460dc2deb

SHA1
8f011266fb9c65518fc97b9e563271f249eeb2da

SHA256
ea1a8bdd44118a0ea0df9ab6478fc0194c9d3c8f87ce8dbbf0cb8e256756f8b1

SHA512
7731fd472436a1d342ce0de363c130d4ee2b1300baed03756a60fa7a5fc58065dfa169a53c768f6d90eabf1727f09b309ef10fd34aeee3bf45f62388dd09fefb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
66ee2e779b886f964f8d2ff0ee796cbb

SHA1
76012f65a34c16292602ddcf192f1c4fdffff4d0

SHA256
d0fa61cfcbeb61d66143cf5220cbcfd18b7fbafbeff1dc62520503312881f6a3

SHA512
38f94f15508187ff523f128e566f29e5028339db0871939586da8443229691cf2662ab3f33ab2e6f68313e268c47a25209bf65d5abe4afe1ad7231f3db5e8601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
0968daf6d8fba42381f169f8f73153e8

SHA1
129f92ac70bd510cc11a697f9b9c5a528f97aa89

SHA256
bd4bae9099e390fe016ee9eb61e8b20883f928797f647fda91e348c1fa6a52d7

SHA512
1b3eff4babfffeb46b310e46406854d16725c7a49a6e4dc8177b6c026410381896073867dfbccdd05116ad2d0a444e66f7a86c90638e55b446b9d451469daefa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e5291759e0f206ed05cb494dc524d4c

SHA1
30281ea21018c01eed22746624b7faffcf859b66

SHA256
9afb5ef506b34968dba57e30d5c6635be816430bdc3f1604f6ac8af3bd6f632e

SHA512
5568cc8b58f40909e1c9446898fca527323669e9b5ecf5f396695cf6a0055744143ce927a0cba3763c32cc37a68a7111dd9ece19c66bd496fcdab7a0792212aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1db2fd2370d5fc7d9e36650914e54bcd

SHA1
098038cfaefaf18c8a030e071e222073438fd3de

SHA256
f9ca41fe5fb8eb08ef5e56682ab8c4e67cbcb93d5662f1f074b20dcb15a37ada

SHA512
de1dd2e85e3f3891b75208a016bfbe3ff75bbf410c03d9f3bc0754983d104d850f93e82a4a21cc8eaee67649100f6b8998cf950da81cfbe96be17453179ba944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba81dad270fb9b5fc11eda9bc586614a

SHA1
a8905b80cf8db89759efe7339c627c6b6ee73a14

SHA256
1b65bdadd53c42edd1ecf727a249c7f08932e9d248d406de983e2fd130a2a7e3

SHA512
ea676dd2ae0b7071f7804a79f2443271e9d687f4f4dd33996bbcda6d29b376eacc748782b3359390a91f8e2b227fb528544fe70cf8d9a2216cfa317be9d4c8b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
6cfee5ffc8bb6024004ea8e1ca430ead

SHA1
45d5227052c7df828f3c269f7a967c162fef464c

SHA256
79e97b90c4191d0d10bddf0ed6dce5f487e4f177ac4de77b04f279e4815b43c1

SHA512
31cc5dcf0bbbaf052b9bd3c92ecf13807f6330573dea8ceeb2b94ca6fd8f2aca7b9e8d8ee0356cc7f0a3bab7a48779b5d2273efdf64b99ac23fc1460965993ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
12dbba3a2b6859d563bc7d6b9d3ec7e4

SHA1
7115a23083f1d62e7fcec80c8efa9f71cad33b4a

SHA256
b94bc26f6103b9bc4a40fc35ff95f6cae7319a90eaddcb201dab0bf114e3f585

SHA512
4afd8f2eaab4bad31b0faf600b1b71338e48d9fcfdc789541a5141d342cd96c6abec4b7cab9df544cefee6fd8c3376ef86df50a09eb0233cf0c39d0580864083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
bef0fcf6e9df4096021edd2675d7cba3

SHA1
6849a37e89f9afb8011529220d525791a38ff22d

SHA256
0e3ac336ca7f4be739e1b2179a9fce1bf2cd364b38e2a32fd80347cbd54bff12

SHA512
70a3cabe1054ed153f3c6445627798b05c7d10b6078e029b7fe8caa80ecc4185de04bd03fd71fad0c199972a21258ccb53499bde184fcee9023c40c51c5a3960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bf7b11e5ad215ea23536753fd3281bf6

SHA1
40b13007671e907940f721b1d70355df17b71cb7

SHA256
b476346c7a6d07d3b15fc37a85b7711ef6fbafbeb57b49e5ebe11821053685a5

SHA512
b2f055dd971a41d0ca3af27fff267592f0d716e54c76148c169ed0372c44f7a525e1ddbef062423016195d9fb5b66acb411bbb2bbf9eb4e2814e2ec8712a5840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
5348392c6d3551c3be7a789dd270b71e

SHA1
0daceadf5e5468afe894c165aac90fd9fc4f822c

SHA256
91d01058aef1ec5f9b80b0973c09c7a91a2a6f6b4ac36e99a0a820ea21126b8a

SHA512
9a6b8ab51075f15846cc657221f6a51b17cccd387cb55dde92ee1763b5549f334a5456c891676fc95d01fe95ad3792402aab5f7585c539cb7df55314c24440cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
88120cd30507e7df1390e28e02be6d3e

SHA1
295ce0fb29a05fe16cd5763178d4770425484c0d

SHA256
f08c045051ed56a505f4894233137c9b40aca9bb70e389401228cf6e4eb7599d

SHA512
cb6ecb4716da5e5035f6f7756ce4c9fdae42ee54a907e67f9fd945970c21387698c7de6d83d5561eb97b51c66d8ff605df50d1be63b334c9dc80fb0c1ef46e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
9975c6413f9311ce7125ad1a846e6713

SHA1
f1d2b9942c9ad69bcef13c8a4331a92046bcc295

SHA256
78d5ebdb7050b83e1b0f7d5a2b839e1bcc3f40e759408833adf124cd20c9fe11

SHA512
9dbab436bd726460887fdd9af2b3db4029c54f90785bbdfdbed748dfa72baf24fe191c788aad81ab22c0aa685ff3f7fc30fffdf2e2977e8cd2735fab69d8c45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
ef85c4984f3d0a107e2f94a2fbea8e56

SHA1
231282bf761a79ba7c9cdca2cfa19053b6a21bdf

SHA256
7ab6ef2b4a8cb4741e3ae790621b2b10ad2e6ac4f5d9676e7064da237b9f3b32

SHA512
c10a0d6efb12d9d21904adcd773c06ffb83ac25cef472d2d546e8962fc1eb1b7bff3c71fb344bf25badf7b4d39bc9727eeacc13bbfb8989e3483c0a912a57106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
d4fd90c8ac29e14d1a233a82404cf25e

SHA1
549fc82e66dde66b21760b3454c147bdb3cafaf4

SHA256
6e8fe4e01bd1d9a858726b7b7d55053ff74d3639b43eb0bb3aa46643db76ab38

SHA512
be14bdf34538b27a71a31d30599565f4ff276ccc8c4f336b0fa3104870f99426de1eb58916707d6800e20fc4f7f8f05c1ad9521baa87547a0dae36f4c57e5ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
41d9cf1bacb147202d9ff2a5323663b6

SHA1
f13d57e70fd38bae5f119d523075b92e4042ddcf

SHA256
557234606d10d030b2d6257b39640d5ec81c60d475c9ccbf31291ea1977a929d

SHA512
1e772f310d94cc65ce81b8660fac8542018b5a87cdbf005c4c83c5643699779ca545eb6f10de114802f27b970f9e483d610fd86828ea5928a7ca8ab17a9cae60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
40baafc8b4d339571143d8d1d329c7fe

SHA1
451eefceb0663a206464ec48f1a0c503c573ed4d

SHA256
d71d5e9b12ff22e35dad666d9d98f572475cfeabdea46046cae2d9190e39a7c0

SHA512
d4146376bd9ecb9a91d28464585dd810be5198dde5728711ed2b71f3d763103df911fcf0b64b2367b7dd8e46bf973f60a20058ae43868b502bcb43fda2a64bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
38af4749759a82d754facc6a40164eda

SHA1
1e7f57fc984dbb76f0924a6b7e1ceb79ffc4f75b

SHA256
4f1660212e6b0b5b275f8b249c08e3f12e0c81f77d8ba0046a4c3986f604c254

SHA512
42f83d4acf00ebc0fc7c86936597b143bec0a2f736b272c6ba71dbe18545696e4ab7610a99767b7da024ba9c1d2b45c53c471ad9af0a53e150764766caedffcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2be940de9d9eec8c16930ce71348cfe0

SHA1
c2efb2d544caf6f31b7145109d9c5daa7811995a

SHA256
c6a81968319ad558bdd766cadfbe3cd966fbf9b9152ee0bbd85ef4a3d1badcf8

SHA512
47c20096d356683f11d8e2c323fae6efa0014a78da562bb3e00a198fa2ffc2f03b1dac745090504d8566f3fba9350a1026212b2bf7daeba850ff9e5743f76dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
42734cee6748de3a6a85738a3eac7bba

SHA1
2cb909f83be0efc2987df34cd20b06fafca8be8c

SHA256
af733c9d1f776e2d0f172e4cf120fa425c1bd038fc68abdfb2b8bd54cd55ecda

SHA512
78fe61152e51db1bc8a07fff9fe94c5c76c47cb06cd3ab946d8b471e7484c5ae1bf628e243484d2d7a83ed8fd4fd2c8d9ccb807d10020c7b27a630eaac0e3c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b10c29df38f309bcb8d41ec1471e63f5

SHA1
723f2c2c426a7a6ee23846a79e85b8d285e73543

SHA256
33f080aede9cebdc0d170237f015409bf55150fa46b06e75ea7a92b5b2dfab8c

SHA512
8b833edf8892a357c34f1a465e2bab0a6eba54deda5511d7caa675fe53c571e3127808bb6596a1c91e7da613e43fb7b0c5221c79cb9638f053a2206584119005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c6d239293085c507951b504fc89347b8

SHA1
a81da068a41f143a1ed411206c261fab995f53d9

SHA256
c217a21185904b056880c85b164ad2c1cba31505ef59fded4763fcbf8033e117

SHA512
2c124248fff4ffc8bf362b1ccde1d157821a5b4fbef38a4a40300ec43fbc6026585426d145cab71cc4b579cec0cdef1af29cd11ff6efd44591ae11f02dea3a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7403fc73b4608cd66e2c6bb177b1dd70

SHA1
5df7a8eb2f7d305488162ecf5e688da3010542c8

SHA256
a3d051fc7fb0bd6a384cf2cf577dba1c679d9583db7a0252c4f5c355505269a0

SHA512
fe0d8144a475bff309e4d76f89578ae16ae08f800e058a28b5704e21433877d4d02f058197045844e66f2669519e3457e89e67917877ecaf18986627015d4b6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5819bd.TMP

Filesize
366B

MD5
90af8f6c4e56751f357f5315a8f2c830

SHA1
89fe2933016295e3178823e1d77ccf4017fe7d6b

SHA256
7698f10fc90494f25fa83d099f673066571b226669ba4003ef658c9c77b6b17c

SHA512
4fa8b2816d257f8f91c561ca9cc6a668e757caa639f8ba8c4b425703e9204b985dc692b0942ae234963cc771c0a4bb87e6f3a33aff88eab7d39b54cdc11c036c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bda5f3183b4d51d6c8b3fdfba4a129b8

SHA1
a82b5b5226808068ceaf6b81c6184d6540495503

SHA256
98044a3254f4e06b24bd20a7e85c7062baf2324841a0f3837c2cdc658ae13ae8

SHA512
bda70ccc46224afe779f9f6a0b3755d5b7172173d449fc58d6c2253887ea1c88114e01150698ae2e245597ce5b1227c6727a55c557d45c7d3d4d9d60e8d6c998

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
646cb002545797a2e5b16dee4137f24c

SHA1
200fa42419d34a527465faccfe3c8a16302427fd

SHA256
ed99172f3491f49dc53f16908a20464e67a980018cd96240ea164b5375a3a974

SHA512
212cb8ce045b3d5c194a0b0cb0a02835e3f5d8be45ce19b704734ff5fe5cfa3b7935eb27bbee5557e42c8a6d89afe60d583bcecee4608ad1fd1103884c9b1451

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
06918a73b4f9f26ed54cee313b1a82a7

SHA1
94bf9398806b866720c01fbe2d0904fda6e3b7cb

SHA256
3128551f76f581e3f1bf94fa39d2ab52f2f8cfb2ea0ca2a937b441d5a710767f

SHA512
56ae092e3a20155d7f6c78d2d40efaa02538eb54e1da34b2f697a14bb03fd594853163ed73936ea98cc2893f9b0d50147d03e8f0201bd515bfe2e484468a7797

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
9b96255caaf0f50c6b6b9d813727174c

SHA1
1da1cc8ffd943c7974c81564c873f0de83fc4826

SHA256
f8a995045727afd54dff206788bdf802ef0f34d9dbbf423dae273e82ca473582

SHA512
099b4ef86824528d08860d3d251fb0b9d3e2c692d4d56a414f16b69ecae5076eb55a55ad735f9452a5c4e79c605393bbad80a5caf5348d672a8b41c84022ae1a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 663461.crdownload

Filesize
1KB

MD5
fdf474320ff140a51f16f065504dd54c

SHA1
c34062ad4e9e43aabd765a71d7c120e3747b2177

SHA256
e02da2e62bb6977b2a0da4aee85a11ffb9c71d8a52ec317639931eb190a2882b

SHA512
a1205e3f4a29d9371bef43aaef81caf26d33ca05d1c0b5bf0388c5eab59993ea2e1f76fec0a63eb0ef52307891eeb7b3a0badbe9c9c846b5c1fd1c6c96cd77d4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 841250.crdownload

Filesize
2KB

MD5
a702307707e20b86e9732b2e2dababf4

SHA1
a6dd3ab996d4bd61549e9aef163bcc2a2a286852

SHA256
a3be26bc965081d00dd3b6e9ab11462639be86194b857f16be3aa1d894c30f4c

SHA512
24aef95b4d4eabf5d4c2434ab4ab0a706b957dd81b90ef14dc5f41fa2656058deec26e0be173ff3262dda5c8ec367dad00b61432ee9c2a21b2ba2d5e39e31e87

Download Submit
C:\Users\Admin\Downloads\ac6a8778-ff26-439b-9ff8-23e313b963b0.tmp

Filesize
43KB

MD5
0a4a8fe4f851fd4ff4d44c9148d76886

SHA1
4b78ec05a8d345903a470148601b6765cf1d1d0d

SHA256
67c2556210366ca9bd601d91cbbbbe9bb2e168fb56a0c4feb50727954f91468b

SHA512
d3e3a9dacb1c9d3842b5b5061c6cee12d1b6e44db65d13047977ccc366b3cbeb607bf747c0698a180cea149e7662896d6a520979ee1910aa966400c42ea7aff7

Download Submit
memory/3828-2-0x00000000020F0000-0x0000000002120000-memory.dmp

Filesize
192KB

Download
memory/3828-1-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/3828-144-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/5032-17-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download