bazarbackdoor | 8ef176944e54df85db028979ceb66b2b6e807b1615f4254c273d4b433caec0dd

max time kernel
419s
max time network
423s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dl2.exe
Size

849KB
MD5

c2055b7fbaa041d9f68b9d5df9b45edd
SHA1

e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06
SHA256

342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3
SHA512

18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc
SSDEEP

12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2

Score

10^/10

bazarbackdoor backdoor discovery

Malware Config

Signatures

BazarBackdoor 64 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

backdoor bazarbackdoor

description	flow	ioc	Process
	266	zirabuo.bazar	Process not Found
	272	zirabuo.bazar	Process not Found
	294	zirabuo.bazar	Process not Found
	299	zirabuo.bazar	Process not Found
	301	zirabuo.bazar	Process not Found
	302	zirabuo.bazar	Process not Found
Key created		\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe
	245	zirabuo.bazar	Process not Found
	260	zirabuo.bazar	Process not Found
	261	zirabuo.bazar	Process not Found
	267	zirabuo.bazar	Process not Found
	304	zirabuo.bazar	Process not Found
	308	zirabuo.bazar	Process not Found
	313	zirabuo.bazar	Process not Found
	314	zirabuo.bazar	Process not Found
	256	zirabuo.bazar	Process not Found
	270	zirabuo.bazar	Process not Found
	275	zirabuo.bazar	Process not Found
	291	zirabuo.bazar	Process not Found
	292	zirabuo.bazar	Process not Found
	248	zirabuo.bazar	Process not Found
	258	zirabuo.bazar	Process not Found
	273	zirabuo.bazar	Process not Found
	310	zirabuo.bazar	Process not Found
	277	zirabuo.bazar	Process not Found
	281	zirabuo.bazar	Process not Found
	282	zirabuo.bazar	Process not Found
	271	zirabuo.bazar	Process not Found
	290	zirabuo.bazar	Process not Found
	296	zirabuo.bazar	Process not Found
	309	zirabuo.bazar	Process not Found
	286	zirabuo.bazar	Process not Found
	293	zirabuo.bazar	Process not Found
	276	zirabuo.bazar	Process not Found
	300	zirabuo.bazar	Process not Found
	253	zirabuo.bazar	Process not Found
	255	zirabuo.bazar	Process not Found
	289	zirabuo.bazar	Process not Found
	295	zirabuo.bazar	Process not Found
	297	zirabuo.bazar	Process not Found
	238	zirabuo.bazar	Process not Found
	274	zirabuo.bazar	Process not Found
	284	zirabuo.bazar	Process not Found
	240	zirabuo.bazar	Process not Found
	287	zirabuo.bazar	Process not Found
	303	zirabuo.bazar	Process not Found
	278	zirabuo.bazar	Process not Found
	280	zirabuo.bazar	Process not Found
	298	zirabuo.bazar	Process not Found
	239	zirabuo.bazar	Process not Found
	259	zirabuo.bazar	Process not Found
	263	zirabuo.bazar	Process not Found
	265	zirabuo.bazar	Process not Found
	269	zirabuo.bazar	Process not Found
	307	zirabuo.bazar	Process not Found
	312	zirabuo.bazar	Process not Found
	315	zirabuo.bazar	Process not Found
	247	zirabuo.bazar	Process not Found
	262	zirabuo.bazar	Process not Found
	283	zirabuo.bazar	Process not Found
	306	zirabuo.bazar	Process not Found
	254	zirabuo.bazar	Process not Found
	264	zirabuo.bazar	Process not Found
	268	zirabuo.bazar	Process not Found

Downloads MZ/PE file

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

flow	ioc
309	zirabuo.bazar
314	zirabuo.bazar
266	zirabuo.bazar
292	zirabuo.bazar
296	zirabuo.bazar
305	zirabuo.bazar
306	zirabuo.bazar
282	zirabuo.bazar
273	zirabuo.bazar
295	zirabuo.bazar
304	zirabuo.bazar
267	zirabuo.bazar
307	zirabuo.bazar
272	zirabuo.bazar
270	zirabuo.bazar
278	zirabuo.bazar
289	zirabuo.bazar
300	zirabuo.bazar
312	zirabuo.bazar
313	zirabuo.bazar
244	zirabuo.bazar
256	zirabuo.bazar
263	zirabuo.bazar
269	zirabuo.bazar
280	zirabuo.bazar
245	zirabuo.bazar
258	zirabuo.bazar
259	zirabuo.bazar
275	zirabuo.bazar
254	zirabuo.bazar
281	zirabuo.bazar
290	zirabuo.bazar
291	zirabuo.bazar
315	zirabuo.bazar
274	zirabuo.bazar
308	zirabuo.bazar
284	zirabuo.bazar
260	zirabuo.bazar
262	zirabuo.bazar
264	zirabuo.bazar
286	zirabuo.bazar
302	zirabuo.bazar
303	zirabuo.bazar
311	zirabuo.bazar
248	zirabuo.bazar
261	zirabuo.bazar
265	zirabuo.bazar
276	zirabuo.bazar
310	zirabuo.bazar
240	zirabuo.bazar
257	zirabuo.bazar
268	zirabuo.bazar
287	zirabuo.bazar
297	zirabuo.bazar
247	zirabuo.bazar
255	zirabuo.bazar
238	zirabuo.bazar
279	zirabuo.bazar
288	zirabuo.bazar
293	zirabuo.bazar
294	zirabuo.bazar
301	zirabuo.bazar
253	zirabuo.bazar
283	zirabuo.bazar

Executes dropped EXE 1 IoCs

pid	Process
2156	winrar-x64-701.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	217.12.210.54
Destination IP	176.126.70.119
Destination IP	176.126.70.119
Destination IP	217.12.210.54
Destination IP	163.172.185.51
Destination IP	35.196.105.24
Destination IP	5.45.97.127
Destination IP	193.183.98.66
Destination IP	104.238.186.189
Destination IP	162.248.241.94
Destination IP	51.255.48.78
Destination IP	31.171.251.118
Destination IP	130.255.78.223
Destination IP	31.171.251.118
Destination IP	91.217.137.37
Destination IP	198.251.90.143
Destination IP	91.217.137.37
Destination IP	46.101.70.183
Destination IP	89.18.27.167
Destination IP	104.37.195.178
Destination IP	89.35.39.64
Destination IP	91.217.137.37
Destination IP	138.197.25.214
Destination IP	77.73.68.161
Destination IP	172.104.136.243
Destination IP	51.254.25.115
Destination IP	104.238.186.189
Destination IP	82.141.39.32
Destination IP	167.99.153.82
Destination IP	185.164.136.225
Destination IP	163.53.248.170
Destination IP	146.185.176.36
Destination IP	51.255.211.146
Destination IP	159.89.249.249
Destination IP	185.164.136.225
Destination IP	142.4.205.47
Destination IP	45.71.112.70
Destination IP	142.4.204.111
Destination IP	91.217.137.37
Destination IP	192.99.85.244
Destination IP	50.3.82.215
Destination IP	5.132.191.104
Destination IP	192.99.85.244
Destination IP	212.24.98.54
Destination IP	188.165.200.156
Destination IP	185.117.154.144
Destination IP	185.208.208.141
Destination IP	35.196.105.24
Destination IP	212.24.98.54
Destination IP	91.217.137.37
Destination IP	107.172.42.186
Destination IP	139.59.23.241
Destination IP	51.254.25.115
Destination IP	176.126.70.119
Destination IP	31.171.251.118
Destination IP	81.2.241.148
Destination IP	130.255.78.223
Destination IP	217.12.210.54
Destination IP	91.217.137.37
Destination IP	5.45.97.127
Destination IP	31.171.251.118
Destination IP	139.99.96.146
Destination IP	51.255.211.146
Destination IP	128.52.130.209

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{3031AF2E-094D-40AE-AE78-C63877109326}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 77362.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
3544	msedge.exe
3544	msedge.exe
3556	identity_helper.exe
3556	identity_helper.exe
5848	msedge.exe
5848	msedge.exe
5720	msedge.exe
5720	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1780	dl2.exe
4888	dl2.exe
2156	winrar-x64-701.exe
2156	winrar-x64-701.exe
2156	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1440	3544	msedge.exe	93
PID 3544 wrote to memory of 1440	3544	msedge.exe	93
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 5068	3544	msedge.exe	94
PID 3544 wrote to memory of 2520	3544	msedge.exe	95
PID 3544 wrote to memory of 2520	3544	msedge.exe	95
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96
PID 3544 wrote to memory of 2432	3544	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\dl2.exe
"C:\Users\Admin\AppData\Local\Temp\dl2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- BazarBackdoor
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8739746f8,0x7ff873974708,0x7ff873974718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1344 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13219528252484512930,5059330372669024586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\dl2.exe
C:\Users\Admin\AppData\Local\Temp\dl2.exe {30AF179D-F368-4A12-9063-5C93C7C61A81}
1⤵
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390 0x2c8
1⤵
PID:5472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2200

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a422a798ed684e3bbc25cca666fe6400 /t 4444 /p 2156
1⤵
PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
186KB

MD5
d52f3e6143a7d8e1f6a8f6b6bf3661c6

SHA1
175e476cb25f293f34dbaff653bb1d3f7f994da4

SHA256
f48852879f66acf6f1a7a9f5811069cb60f12f422ced770421c4b72161d9a7fa

SHA512
cb36397bc07dc5ab7844838c1dd9469fec8ce10a9e3de693767e897dd73fce7b22d23d6f5f84b965a4f1b3c4931cd7ac54e6fd2e677db037fd21e0c6d7e41791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
70KB

MD5
0f6e110e02a790b2f0635d0815c12e5c

SHA1
2411810c083a7fda31c5e6dd6f1f9cf1b971e46c

SHA256
2f7018f3c214ace280e4bd37aabe0690bd9d8d0532f38e32a29d1f9de1320605

SHA512
2f2fb7c4ddfb6abb5dcde466269f625eea58a2c69d25830e6bb24126e7679ec7c83fdb0d8ff2a7de4dd4b994513f5e80813dbf1f5d6a9a474c3a60d8bee74f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
c79d8ef4fd2431bf9ce5fdee0b7a44bf

SHA1
ac642399b6b3bf30fe09c17e55ecbbb5774029ff

SHA256
535e28032abf1bac763bffd0ba968561265026803eb688d3cb0550ad9af1a0e8

SHA512
6b35d8b0d3e7f1821bfaeae337364ed8186085fa50ee2b368d205489a004cb46879efb2c400caf24ba6856625fe7ee1a71c72d2598c18044813ecde431054fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
771f4dc9c62dd576d8433571a857a40c

SHA1
7b4fecb308d4640cbac12494809d82426607122f

SHA256
5cb56ef854300e6c5be352cf1ffd360f4fdf272edf69ce95b9b3fd4c6473c3be

SHA512
ffc953bccd24128e7a04bcf64a17a50ba21e460efceac4308206eee9aee86a46d1a02a7cb7e3faa4f554c2ee12e8222acf281478651c1b70e06550ee5fb8b090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
27KB

MD5
c3bd38af3c74a1efb0a240bf69a7c700

SHA1
7e4b80264179518c362bef5aa3d3a0eab00edccd

SHA256
1151160e75f88cbc8fe3ada9125cc2822abc1386c0eab7a1d5465cfd004522c8

SHA512
41a2852c8a38700cf4b38697f3a6cde3216c50b7ed23d80e16dea7f5700e074f08a52a10ba48d17111bb164c0a613732548fe65648658b52db882cacb87b9e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
59KB

MD5
2ab8f64709fe0aecbef8584619cd03ab

SHA1
5dadcee7e80be60b320f62dd73ea8435eb04d606

SHA256
11f73f4e2e658e8e44c57576e77d45d8b47dd4bb16acb22042466ef24f3ff06f

SHA512
13a3673d2862d5fe850fbd58dd76ba74995d318a68533b5b4cef4d37f9d0e2d4d97943a2e585428a51ba8255bf2bde5ddd69debe09d1b224da8a4a121af49b2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
36KB

MD5
78986f8aad1b27b913ad5836ddbead99

SHA1
c976515ad66a576bc943f60cf19ef8239c3c0575

SHA256
e5cc3939f8896662c5415dea3202a1076b0fa717683f6ca3473e7762b6226365

SHA512
5d4751dcf2f04e805a642e8f39000b1f2f1a3d6741019ed41d1abc1ea5391ae654c7a74104eb1a55b2b4bf9f845d83fe66c9bce9042853e120c3f2d962b09e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
73KB

MD5
1df8256199ffcd2ac1c8172bd9072a3f

SHA1
64b758304ebc2763b2233ada7ca45084b87e6a4b

SHA256
ee5cade62addc018006b409850600a8949e352c88737dc0bd6a5d6aceceea36b

SHA512
70c36ec0b0ef3a7fdc3ba51dcd0222e2867a27471da60022f207d1a92f971c31aa6ff7b835cc58d56d863692347473ece8ee14641f91003fe809f0bd0081e412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
30KB

MD5
888c5fa4504182a0224b264a1fda0e73

SHA1
65f058a7dead59a8063362241865526eb0148f16

SHA256
7d757e510b1f0c4d44fd98cc0121da8ca4f44793f8583debdef300fb1dbd3715

SHA512
1c165b9cf4687ff94a73f53624f00da24c5452a32c72f8f75257a7501bd450bff1becdc959c9c7536059e93eb87f2c022e313f145a41175e0b8663274ae6cc36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\943313632c216fad_0

Filesize
330KB

MD5
6934061bc1ae51d16d32f3f040e863c8

SHA1
16acefe0edbbca13ec26c096682e15cef1cbb4e7

SHA256
22a515c0b92f0b3254d2aa58a3adb159cce4bbdd8936c02eab84cfa6a5944777

SHA512
a58028313339b362c22a5fa4cb27c95d56cc54519abb39ccfc2e0a2bea26fee37fc457763186ea2b0242804c56aa7d34c4d828aae503c9044e0d1756802753c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ea9b8918ad020319_0

Filesize
289B

MD5
f18216f945687634bf4e8af655e842c5

SHA1
089df3b2387a983d5a86080c02d3349fbdcf7a9f

SHA256
380f67b024c909f8b12e15ad576c786b93086f7b01a88c1734320293414c9e87

SHA512
bcc8bf7c6be170183b27471687220518ecf4704b5973943b81be77eded901427d188f2c08316fb317b3f4ca86444ab08b4e1e75124c5989d7704c2069340fe7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ecee7892048c4e0f3074d08802519ff4

SHA1
b2e37dca2cf0ad0156606e226dd8ae5b66ba5439

SHA256
69ba0657ffd3cc220e991e3e1fa96327e1df891447246c984c487783149df6db

SHA512
639874d81835f17057adfd137142036a4bb52a68cebc2e37b7aa7f1c490f872b97b09ba0186c1d094e5eb6632d2d7d79963f9de491e3eb2d7ea4033a09280484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e88b618b498fa290a6f79b5f7af9cd6a

SHA1
21c4dad36b1fa315e5eda0c08e98cfdc40d05c65

SHA256
0bee9b82a61a3dcb9829be996320e78c4bc4eb6ab2017b1881c87d995136cb07

SHA512
5403b583d441caea65f0db55c0c279590237dfb2f94876b5fc6f89f32a13812d1ec3afd4c8939a3656a5f004c551ce565c3aae5ac7ca5345cee0b996218ad1b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
629e956d19287ad1e8ba65a60b30b248

SHA1
7bcdf1d17db4f8995b46bf22929359a06f406aac

SHA256
4f1ef69e4011a6ce7865f45cf95ea96463c25b2c08d8ee376e66d1e5ee70cc30

SHA512
8dfe5768d2deb4198beda5623964a0795269698f3a1e8b565f5896dcc96e38ffae7e5de7472637c738c5761c3c830e0adad0e08556fc409b46274f96dd53f5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3791c019374c515a183be0f99b621566

SHA1
3bb831945d0bbd0af3e90f6e534e2c1885a7fa6c

SHA256
5199a762eec39366ce21dbe292d9cc49c4833b9d86160e5756d8a7a5bc7f3f7b

SHA512
30e470024fd8996a2a3e1b36fa57999af36b0a2febf47ec7145dde3a55fab6f0c7454a7cee68da8f6271646bc94e3c2b77d968bcf5ce3b129c402d1d22c4fe4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bf9d48887df99cbc3380b4535ba74ecc

SHA1
47243c7df90a54152e221329f7e50e88fe6f1be5

SHA256
7b05a6a4e77dcf1a0c3c1f025b0088bf0998e1edee9594d0cb4026604204d3e9

SHA512
8a7d5f4b3c5256f0785fa6fc7adb09bc1fe6218998022f45de22f092077e0d182242d40dd232b265492d43ff3b980f01c26120a0388f9892dea704778d99eb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bc3c6fe84ff71f8cd61e2a288dd09dda

SHA1
32d5efa1ca1eafcfa0ed386ff920f27ffea2bbae

SHA256
9f414d1e001a93e2555252a8408937d3b39c1686bbf476ef2406e5b6b95c675e

SHA512
605b7ebbbdcb509452b70f847855d5a2205b289c335e24a802023af4dba642c4cbf4a117113b250da53a1389470d964103f95e04e4ba4483990029430de15dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
01b8247d82946180db0aa9c015c3d76b

SHA1
a9973f07dbe84113c029e5499eefb2001f52cd94

SHA256
e81e576734d4831426b876ec972217159476da048815997c8b4b1d1bc5c262aa

SHA512
f14eea055564476f95d0b967f70f3e8f42c736d0a115e208f0ad5ee263dbd040542f6cdae3c6ec14a87c7264f5dc2fc21ac35341c0d3d73cf31c5f9896b1d378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b380fac0b5ac41e0c8338900e2f58365

SHA1
7f5e67d3d6fcfbacb60611d89f5654361190fa35

SHA256
4c84449278d542a1bca2fa33a778d80d99f6bae369376dd64bf71f2be2a7e88b

SHA512
87a9551836b30ae78bf34d6d49a2ec4b3f1ca9eab1944e15447fac08d35c8cc8cf196382a6533448afcb8f0f7a97b1af0aac4408bf806a7e1e8a1fc4b874d44f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
52e86119e803bc697b1dde593512ed26

SHA1
9268638abf919d08fda7b866b963742536c2a256

SHA256
93a1903415a0f5b0ba56176bfe48742ca98ff3f7f282301895aff52b4021c178

SHA512
b0f1c89b980ba8f42280bab21b0ed024eb67e88bf63185c7ff10d4acaaf5cdd8650831aa95f4011f04f73d4e393a6e1c1abca175b4112e8f9cc643b04accf37b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
f88be7f1d65748a8a9f41888d676c8df

SHA1
823c5185fa83b3ae332928b52df6b96828ad1510

SHA256
2e2d553a6e7e3839be6dd7bc7db526f5f311f4a94e38293c2e1759566944e8d8

SHA512
addc9ee21c3c963c378904097e6557f58ba40c032eee66c29bd2f2c2f6cd9087359fc70243d9d83f7ee208d4d392a526781a4ad6ed2d2c9d18a0284914e58f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
16e119b079543d26fbb9dff9c932d7ee

SHA1
4c89cb127ba7b661afc4978ae7bfcf3c6b01030b

SHA256
7f09aa27da7ab16f479f10689472a0e0dce0a7cbaa734c181e4ebcfdfab54339

SHA512
fcb4a7002ad7c17e08661dbc800be9a398aabdbcd157e11ab8fef4688c66678f2338cb2dc95efeed759853931dd8fc6eb1158ee240ee91820b84c6a40af48a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06bdc423bfa1e839ab23240c54f81d49

SHA1
ff1ad9226cc9b7ab4372ff45119f3eeebfb78356

SHA256
8ceb0a55cd7b2bf2f2a5e52adb9321272ac91b01c5040470f40f6438043e0063

SHA512
2e1ab796b15f66f96f8952161bcdf7bbcf160c0d1a62d089c778ca04235df568fa6db0cf52f0fd28cbcbdb5bbff7b9cd945225e13752cc66286d7979d6b00f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b7a32578a6222a7b726442de8c9768f

SHA1
b90c1b5baa0a3e20e8cafa7e81a05330ab4d7a9d

SHA256
facfa9d59e6f89713933fb96733dc7c95dae5472e77363abfced49fda65a4727

SHA512
5c0636d31e2289fc3d80d6f1b237c84ebf247b7240acca947c5d8f371437beb19c6a2c97449c871999683425f78f578912a01d028f72186df877bbe4235633cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
70191205413fb5779d8cd9b31d29633d

SHA1
f004a3351b29c9a551560fccce49314f8525d72c

SHA256
20545eeaf16c9c68fd00695fd159a00b6de5c378c5ec9ace31cdcc7965806b26

SHA512
2ec7305c224c02d9912dedeca0d3bfe01c43ee782b64605f50770c981cbf1ddd99210d6e5ab19c1821d937ae9d0d4bc798d695825f57ff96ae452db1a12aef67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
389a97cc4c8a1d508ee997d7dd947fea

SHA1
9f6824ed59bddb553b3be141bbd8bd91fc3e3a49

SHA256
1a5e1acccd40b9f51a9d5ea4f03871514e3ce47736aa424b61c204e41df8b421

SHA512
fe1d038e1717c81d02bb47079126fb764ecbb2ae2173e6e3296c2d464b3b6995a85a7cde2c7e222c00ae2a66cd4f8b7af94b35b9599280c27dd05129cdd4e14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
11bd0eee9eb213da96d9173bebc83c02

SHA1
e2e60f33b0e5e8509f842fe4f1988a35a6472b4e

SHA256
f4ae823c48ab89b21797d53c19fbb0604e979fd0eb5929e07966d2f23d05dc73

SHA512
755b7dc708ea489e85c78a029d1beb599be1b95dc9cf55b4c8751deb707d2e76a3ebd509fd78a6dcb62d357be78f56f91bbdae564e0717bc29d0580eb11e8293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
50f7f4d4b9e1a0975c8998b4a2fe8c4f

SHA1
1ab1883f09d8d35b26a5eb76af6605a2deb577b1

SHA256
267737dca167f1fe2e21374f24286d881d253719e76f55dfd3ae2b985134955d

SHA512
4991f010d7835bac379318a80a5ef9923fd05a2d52f13ddd3e608c480625f234d9fceaba836b175d4b7ebf56597188c69a173215cd378fd258389bd067a3bcff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
fe139bbb785a9f620a9a27d6534edc1a

SHA1
496b7768e07722cf1b5210e8f633a222cb584398

SHA256
41816b6e54732272bab99fe1ac902fe1c83b80fad5caebf4f0f80806d09e5ec6

SHA512
5fb7c21177a93d0a62feb056ff20a3cbf3a93b2dea3d45ce0c675e940ad382bed91758d4e96db76cd849c4d12d4c8be0e30a4387ebc6d8491e93555c8ea70bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
781682dd187b3e9ec7ac6458ef6ba63d

SHA1
387ef055f17e9ce8c87a796578bffec101f38af1

SHA256
676062fe1e88a08f9cbf0f7c6a1e894ae97624de0d96e1c4bb1f38e0d19c4a97

SHA512
f8640ae836de61eff081f29736bd8d82e81d9b25887dcaf9f07e4d5815ac532a257e2d3f467e8aef94f33a8fbf6dfb6aee304bfa5755de75fccf45b998190c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
bf8832b5638bea56c1a7f0dea9fdd3df

SHA1
6f3475616acf8e37124cf4d339265551fd24d639

SHA256
8a1ac46d0345a5589ce25e5817b80d66bb886a5986804783c73703353e27c127

SHA512
dc8c17becd006e79ad02993700a3f84b75d17c415e0043115402b8a22d44e819f03c3363a0b81af054c38ff639fdafc8068c4518b92f7dd94e77d7886556646b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
c0af7e5a6a0b87dc40840982a146dc15

SHA1
d080deb312cc66eba82b31df745450f11c63dc2a

SHA256
83991f015b790bb650d75d706bf3aff518f9dfcdaa7a09d01012283fd8b29318

SHA512
432158ec9cf2975519ebbf4fe34357442b111dc88179a4023fe9fa756d9848abb2c44c02edc5e37f9eb70e5c3ab6a01b570c9369d859852fe277f7ef8c6db682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
336cf96e6c8c790045f76c4ea5e9c15e

SHA1
4ed3140749664e0c1bcac19b82a5201defa9eb6b

SHA256
6b8254fd7161f3f1c25400d45a32fa7bc9b5215d62b123d940d30b17f3cdc5fd

SHA512
21d55bd2714b14672657a4ab27444169d0ed90aee9d5839671678ae1a64f525f4c0426234ba2e565b03fd425189f9517460a93a8179b2d3778260aaed2a53045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5878d5.TMP

Filesize
538B

MD5
d0cb18dc9a9858a8c37c6426573b82de

SHA1
e6a7cccfb4e750db89aa348f0419c4ce0c774eb0

SHA256
d3df3f58dc58af19af1b3dfb49588609321646623a92c386b13fabd0e7987ffa

SHA512
ab60ab9efe4172be48d93d0375dadf5edd2af5a68fa9c939f82c32c818a390269678cb52f3c8b28fd25d576a0413b2c8291bbf9f99f0fae73146c01af3b011c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a44dc004-28a6-4767-922e-b161c65ff113.tmp

Filesize
6KB

MD5
77148f34a7f742b1f503bf375b5f99fe

SHA1
8d5d9f55a6a5a36c08b348e5d06f50955090240d

SHA256
213e2b23bb0acc07f767324f6f3a43a04d3b31d1cf480a5ca206bb21ed7cfac2

SHA512
b10a1208be013f6c07dbdbc922aeec9f3f92021b83c314b454a7939f8ebe09945e8b1c6c64526040000c66430755970aa83accddd661e7a8d59f6252dace035c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b678063914230f2292287fa5d2be5980

SHA1
fbe20a378a44280bbe1f039bcb90e070385a8551

SHA256
da3c89778a858ae4eb2075e1bb2a33f476dc6e1c869a299c7e4efa7de03f0bbe

SHA512
7005870e64099b4c12d4be8cba6b4a1027a1803ca54857049716338afbb38856181aa7934e4eced39eabecbe81adc584bd6b3f0ed148c0a27ebf56b6f3ac493d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3205c0c1d8d210ad10f4a9c2d58cd010

SHA1
b93eca478803aa4beb7da279d0861bbcaccc7744

SHA256
5b542d50b4f510d5da27e2128874cfba8e68911402b4500b4241be6c0b55c472

SHA512
18ff3440c495bb48fd76d3c42592b8e33899ee7e71c086dcd6973a5b11b093e1b43ee5c55d7e00eaca8671042b900102ab69bc11bb3cf5a9ee6905f68cff7fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1de3b0eea81225bb832e2edb2febbd6a

SHA1
6cbfe53fefa1cb49a19425db2c4ee63374cdf0a6

SHA256
22d6d3fe19d1f1039724e2c53e0411d36d9501b61d95419020a8d60cc7395b95

SHA512
e88ec655b8014c6fbd872a432c72b602ff95b3e8188d67225237d8fa44243e58901fde2b125bfe7867053794864d8c7f89864758e656bb93cedf106e62286199

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
a1b8195486bc232aa69918f79157172e

SHA1
00a24000fbc0de01e407026d42d25cead7c01cc8

SHA256
57ee8b4017acc35af3f38f1af32d07ad5271b0c76bf0177a32300df7782fc400

SHA512
5c46c077dc10c2920fbce5083397b2f6cc822734446c40732cd95eb353bff36e9b798a73cb924d2bdab60dfab9b891d91efcca7c35605c15d59e46ff0f7d5416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
340e2ab4ac3dbee8a1a107c5f55e14a9

SHA1
412da9c54a94ac462ac5f78b73fe6118f9a65e73

SHA256
afad03f13d48bbc136a35bf1f9005e38a27074727950cd848556c77559424c52

SHA512
1c01951dc75b5562d0e145510593286b6a071078a729e2ad884aa64e29f8140cedc64bfeccf94247269234e5f40fa878860be875498cb5e0738e17d4bfe68c3c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
e74d60f9c318d1db2d5a18df1d405da9

SHA1
e9a7ce9fbbfe9e460ec973bfc8d5d1a9d03d4fc8

SHA256
18dd05c1c993b73fe7a19a265166813e6f2ce62eaec3ee2600e52a59c97d4b47

SHA512
7647e1c3e4ffabe2a99ba3b8bd61c68d9e4330815952d527d61d6e3cae54d6882b2d7b485ee58c74da40402d96d3a5aeb9e97c5dd24d96d5213b78f5d9613a7f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
d58846a1d20ab37d2ea43d3fdd96fe57

SHA1
9b6fa4789871fe37e8e9130464b38b1eb8bb55b6

SHA256
7bf7b02e6305523807f33837bb6067b73912a6075b278c1f7541ee6fd9adcbbb

SHA512
ee08bf6bf338d291ab0e88fc8e8f1054116413766fc31888a6c1336fe768233d2cd67e30a467e81cc8c4c4ee7a23c3cca107735f465bb4e6d45739b4e134984c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 77362.crdownload

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
memory/1780-90-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1780-8-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1780-1-0x00000000020F0000-0x0000000002120000-memory.dmp

Filesize
192KB

Download