hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbjhPU2JXeGVTU0NZTi1qbmNfemJ0SGF0S21LZ3xBQ3Jtc0ttMW9NT0VibUNxNTljRVo0Z3Q0ejJocnJYY0xESWxwMmFIMGpMZlEwUXFLLVQweGg0bnFSUEtfVVJGSjJkYzZnX2NwRHJVYTFoZHlQWGN1eWxfSV9YVzZTYXFsT0JrUEpFSTExVmM1MFMxd1NLUGs5TQ&q=https%3A%2F%2Fwww[.]mediafire[.]com%2Ffolder%2Fn5pt0wxnn3lua%2Fpass_2023&v=vTdgYg36_eE

Resubmissions

20/08/2024, 21:19

240820-z6bwestena 1

20/08/2024, 21:13

240820-z2y56atdjd 8

Analysis

max time kernel
312s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbjhPU2JXeGVTU0NZTi1qbmNfemJ0SGF0S21LZ3xBQ3Jtc0ttMW9NT0VibUNxNTljRVo0Z3Q0ejJocnJYY0xESWxwMmFIMGpMZlEwUXFLLVQweGg0bnFSUEtfVVJGSjJkYzZnX2NwRHJVYTFoZHlQWGN1eWxfSV9YVzZTYXFsT0JrUEpFSTExVmM1MFMxd1NLUGs5TQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fn5pt0wxnn3lua%2Fpass_2023&v=vTdgYg36_eE

Score

8^/10

discovery motw phishing

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
5892	winrar-x64-701.exe
2752	winrar-x64-701.exe
6848	winrar-x64-701.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
392	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{C697B5A9-D584-402E-A73A-8D967ABE5E5C}	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 954362.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 755779.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 839175.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
4920	msedge.exe
4920	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe
5864	msedge.exe
5864	msedge.exe
6840	msedge.exe
6840	msedge.exe
6840	msedge.exe
6840	msedge.exe
6644	msedge.exe
6644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5892	winrar-x64-701.exe
5892	winrar-x64-701.exe
5892	winrar-x64-701.exe
2752	winrar-x64-701.exe
2752	winrar-x64-701.exe
2752	winrar-x64-701.exe
6848	winrar-x64-701.exe
6848	winrar-x64-701.exe
6848	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2008	4920	msedge.exe	84
PID 4920 wrote to memory of 2008	4920	msedge.exe	84
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 3836	4920	msedge.exe	85
PID 4920 wrote to memory of 1624	4920	msedge.exe	86
PID 4920 wrote to memory of 1624	4920	msedge.exe	86
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87
PID 4920 wrote to memory of 2760	4920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbjhPU2JXeGVTU0NZTi1qbmNfemJ0SGF0S21LZ3xBQ3Jtc0ttMW9NT0VibUNxNTljRVo0Z3Q0ejJocnJYY0xESWxwMmFIMGpMZlEwUXFLLVQweGg0bnFSUEtfVVJGSjJkYzZnX2NwRHJVYTFoZHlQWGN1eWxfSV9YVzZTYXFsT0JrUEpFSTExVmM1MFMxd1NLUGs5TQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fn5pt0wxnn3lua%2Fpass_2023&v=vTdgYg36_eE
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab34b46f8,0x7ffab34b4708,0x7ffab34b4718
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8580 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8680 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9260 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:6252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9284 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8680 /prefetch:1
  2⤵
  PID:6520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:6924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:6932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9128 /prefetch:1
  2⤵
  PID:6944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
  2⤵
  PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9196 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8660 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8620 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:6420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:6744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9316 /prefetch:1
  2⤵
  PID:7048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8424 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8736 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8908 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:1
  2⤵
  PID:7108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9764 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9740 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9640 /prefetch:1
  2⤵
  PID:6480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8572 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9460 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8912 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9584 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8848 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:6464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:7068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:6372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:6900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:6952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9544 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:6180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8780 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8336 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8888 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8792 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8464 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:6720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8944 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12162234421891642195,14476434708394415789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8920 /prefetch:1
  2⤵
  PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc 0x300
1⤵
PID:7024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1232

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5892

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d5388315a97e437e87da5fe496f5f40a /t 7132 /p 5892
1⤵
PID:6924

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2752

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c61d56a5cdc741b4aa8833722d9233d3 /t 2240 /p 2752
1⤵
PID:5340

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6848

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\f6296782bf5247af9093ba1b84173e6c /t 6892 /p 6848
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d546e6e-a449-41b0-b4dc-bee44ccde454.tmp

Filesize
5KB

MD5
96793832733024c92363b577d278bea6

SHA1
e81cbddc6af22c1922475b56bf075afbfb27e221

SHA256
be9a6475deb7cd20c1b00e1fbb8d348b1c1f8541004fe85c21efe7318a8cf441

SHA512
a2e90aecc5da13689053847fa759fd5a18652313f327f0f6b800579fd8587974ef37de58c0aaaba998179ce3b44859731345059d0d63fd21bc4d1320a931ed3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4fad2421-89d1-49a7-b132-d8788e931ec4.tmp

Filesize
19KB

MD5
46e7cfd1e5bfb75756f4f1eec2214660

SHA1
2c1b2c6b529c7f62f7c90336c3d652586171313f

SHA256
26fa1dbf952cb64a6232f30b59454cc06b55cb15748231a506fdf8ef069f64db

SHA512
d2dddc707aa20a246d66e5a38725bf00c7e40a05ad9e71dca1047b56a8259d24f58f0d8105d3a1755d628bc287d506718d25289ce5b9df455e5b97e9d4575fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
21KB

MD5
ace358a57d9eba2089bc41e40bfa68c5

SHA1
975e366a833ddaad2c0c6e3791976e977d219148

SHA256
173ab980c903ba3f151dbd89f22025af4f253419333f7accb50fd67fc57ceade

SHA512
af9bf0bd8decda137b039bb37b213c8acc8c37ad200b94b3dd21ea806dab9baea251ae4f3342b0f2e65e78d6df613e438d635a5560a7269ca198f6c406fdf337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
135KB

MD5
0e2cc05bdea72478646af8c332699cfd

SHA1
17d74a6c2875b20c9ad0e1c301c55002be0f8e6e

SHA256
835294a99a82a2f3b8dfd2aa741791769c2206c8c86d0a03c87544d35d95e2f8

SHA512
7763b150f0b35503116e5e90f4175bc4b98530796eed6047fec4dd929bb9ce9dadf8e5135da5d4760a94efb4eda9dbd78845b9b20434284c2c61804864bdd163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
17KB

MD5
67e30bbc30fa4e58ef6c33781b4e835c

SHA1
18125beb2b3f1a747f39ed999ff0edd5a52980ee

SHA256
1572e2beb45d2de9d63a7e7fe03c307d175b2b232bad2e763623dceb747729ba

SHA512
271d4a65d25b0a5d2ff2fe8f3925fc165d9b4345893abfd919061d78ffc5ffe8890ded35e41274ad8b860f06264b027cfea6030ec9411a4e03bc6d7cb4d4d228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
19KB

MD5
5be81d7ad6cc31905fc542da6f7c572e

SHA1
7e8aa144a7be977232b0fa8433cfdd422a1cdeb3

SHA256
7bce00c6824d69355bbbc48b3418183b4ebe106b6fab6d6c6884679a83e86054

SHA512
f5d3418399d2b20d1a7baef59b30810583d836ac82cc54d3181e5d21852fee36391e9d485b0832728070d0df4602df7d303aa76d55e0738a452184873a5a1831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
31KB

MD5
719937ab744e439bedbaa0798f6d70a9

SHA1
590ecb53ea393f2c82d3ebe92c5fa0cd7a2c70d3

SHA256
2fcd7c25566818c002b2dc63de66067324b245215890afb47d4f96337b97de01

SHA512
43c12b8cee402fe81d1c8d1b7194710cc2c993c17678918d8db01620462b92a194c1b6067ae1932f3859f10045548d201e0e0b4c59b113c3e2327a622d5f87e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
98KB

MD5
c778b98ad455113f31cdfa57575f3c6a

SHA1
1d3e7e6ef18ebc1052cda8dfffb6a76135371358

SHA256
c40d49f6e60553922f447afabc8df358db412cb0b8a9ac2464dc1f5aefe479de

SHA512
cb521224c8421c2c1d55b72718480264bf3038b6951c8a2487474ea5f122326b2f474868363620f39c5a76c7fdd8e5f9c7a7ef0cf3cdad1ad4769ad76035d106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
104KB

MD5
7651b1187bb58ac4c7be625337b35e5b

SHA1
307d969ef4137a66fe2793737dc1c546587c7f43

SHA256
0632850d01a46bc2f8c223155a4bf6c398b33596bb711e098440623f118c3968

SHA512
a81d2f768af155bdc642941404e7ddf95a2cea33c9374acb5fe32f6f5266e337fbef32f904551f61fcc9f9ab5a1c6a5ad130ab85b38bc2258e2f82c0ca1e9c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
135KB

MD5
b787bd69348e38aad5a2c0f0c899e1d7

SHA1
bb99c84d3929a939f79ca1caa9a4922ea9367b8b

SHA256
e3957b9ca5ebaa433f3516423ceb881b6828c757a613ff8889f01836adfc33c6

SHA512
d5e26f83e0778a086109794defc26a3f23bcd86427c37e26d7de565d061649d5a7a8cf22c0b7e9120210b78f87fe003bc45a352a2914537776e2a5f2e7f46c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
82KB

MD5
1a9a01718576ed7f004fa01268ae75d2

SHA1
b7685e99347276e3ce1d449515e48666f6b419bd

SHA256
72786b170f010ea44fa8bf6e808a93cc3e80ed02518371e3a24ed6a217481d8d

SHA512
bdfe4d451616b875d7a42d5ad2b7803e365285f4da87eb53df922c10b5b1e568a5aeae9f6a2024b3c03af4cc78cda78c219a31a88e468b5e12c875e9b0ba52d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
26KB

MD5
790bc527aa7cc08b417e0fdd6d9232bb

SHA1
bf0356d4b8f2b626a788b91969dcdf5dfeaf7fc8

SHA256
f4961015ac8f30cc0db2bc2f5a7d17edd2d99374aa70c2186479927b24a1eec6

SHA512
513a92ea6063bcff86c9ecf1df95f04bfdc6972ea9260b327db4e1f83983dfd71f491295f30302332c2622d4d4e252713a525123f7045070214292f369b0f232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
47KB

MD5
f91166c79fff1970b0b02047bd37b75b

SHA1
2cc00fbc35e9c0797377b1c26dfd327512e5d494

SHA256
ac7fee61c2a52ef6a094b32b8aee4ec3bbd276c9e9fd4f90b21976c44e740e14

SHA512
a99dd66317edc07cb10689f11d72716ae5039b50ab2572313035d826bc7db46610ada32d8e0e664337c2e7720a6eeeaac1b378284534f9c980573b940b696e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
148KB

MD5
8ade5597eb17b7655d0b73272c5838ca

SHA1
d3a409dd1fe3b3add6bdb6b325c444fdcda7b2f7

SHA256
f267e79862f97986c1189f9878cf598fb56194d4954ec5325e803db902f981c6

SHA512
9b1486762998a22a026b69b240f3fa787f7d21be6b3e51043b7728818bc1f6c313052d0d52286c2f7fdc56a3465fa8c6906f542b63f6aa43f776b99d4ad583e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
78KB

MD5
c922acccc02acc19433a4f2bd9c7756b

SHA1
9c6d5f45e038a14eec6a1066f27dbaecc4d452ca

SHA256
fe3355524367df39cd8b2061d5c5516ab2daec5de5551131d7a1cefafb57f9a2

SHA512
e65bacadb910a49c41c4ac12a0b5baf10c79499f60847560e3896b4d94df8df447a52f54feed48224aab5a5958931ddd7b34ad2db1d562126c8f77136fee3a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
20KB

MD5
ece0cd052f4d12f260f04a3a41781bc5

SHA1
18026804351a85f7bc37f1e20f80310484ae16fa

SHA256
fba8840ca69cc801952c80f541b3f15d0148a11a57f993faf207c3e3d9572daa

SHA512
486039ab99e2ffe40b8b5730add0be9b0f85e6ef403e522680afabb017f960ada5b9e23eb7f0de650cf7c1c1474e5648ec420e7a82edb4c521d822e035657360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
82KB

MD5
ce0cbc0d3094f8f669a9a136896a542f

SHA1
495bd4aacf69de7b58680f1504dcc09693e4fc33

SHA256
16421c1fd025e54a26321c9abe1801b32cc9e0ec2929b90fcbe9149381b20655

SHA512
3d1d1a485721d2248a65ee563c8af08bc65dba9f0b42e50c9dbef35e3ca0b2063768d253c12f6c4b7b9af74490f6d0e859621f6751ba6b1249da96173a3a6727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
27KB

MD5
7222d69fbca9d2c3b5b35d34a9265297

SHA1
c3c833645b8945d6deb3da20b314fee12e959de6

SHA256
61c29b97732c7b66793b3e9e64dae71a59310629cc56d39a1c37c8d6723a6965

SHA512
3a40756ee68e77531217a3d01dd6004297a6bba366eac42b6fd51c2ce969e8afb72651b9819f2447d99db88f0367a2e0b4788971d8fd60b6281393c80ebfafdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
38KB

MD5
bacf9b57dac78f50bd32901ed94e2afb

SHA1
0ce481f457be11d31e4d9cd9f90361b34f072be6

SHA256
d7f02d336f937440b188a287eb39d0544e16b2a6af6bada16bf469a5b085f7bf

SHA512
109485a740935984040a11a47d87631aaa5fc9e399bdefc3b9f0d2a95aff56e04718be43e080b5fa93b5dd232552ade85abc46b57a37bbe9adbee7dcea1f54f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
85KB

MD5
90258e91c1ce850458aa4825d2f0cfc4

SHA1
7e649bdff650f4e0bdcf942d75b1860aec70245b

SHA256
0dfdc4f07bb7fef8fd49bc40877312c5f2ada714c872bf14270f92377a942d56

SHA512
26c1c29e6f8d2edd5e80e234c248ea6a19e00145a3f9e3851452037a5f30e4fbb1ecbc3750d8cf08ee289f4287fb0c960e0386c997cb6ff3274333c5dceb0143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
63KB

MD5
7ddbde8dabe31eadf6b216954bb6cc8b

SHA1
effaaa96e8fd4813865b60af30e98b92170a4aa8

SHA256
c4d9638bebfdc9d06bd1aeb8d771434ee59e79806d55a08471630c06792566e3

SHA512
044828c2efe09651fbd05d6d8beabe196168523f1596b01509f785dc368039555f8094b546d3da4ec5fbe37bc026fee4dfdb867d54328b01e2fa9dc305f30d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
20KB

MD5
88924e883819450fea6752faf211c02e

SHA1
f65cd48ba61e6854b8695490e82b8ef1256c0ad7

SHA256
2775bac57d4aa61e0bafe9902dda744b81a6bc392a953a125fad1da7c949fbec

SHA512
c3aaeb5f7016f819015b54ac7f2cde14cb71b613b046b7097a61d7836f3cf67d38bc6eaad619561c72828d6f930de0362cacddade2f4590389e6c363755c68e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008f

Filesize
30KB

MD5
888c5fa4504182a0224b264a1fda0e73

SHA1
65f058a7dead59a8063362241865526eb0148f16

SHA256
7d757e510b1f0c4d44fd98cc0121da8ca4f44793f8583debdef300fb1dbd3715

SHA512
1c165b9cf4687ff94a73f53624f00da24c5452a32c72f8f75257a7501bd450bff1becdc959c9c7536059e93eb87f2c022e313f145a41175e0b8663274ae6cc36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\336a68eaaf209f48_0

Filesize
309B

MD5
9cec80b141194305e09192faa4c90c89

SHA1
a7ed0a2a0b8e652475813de8ec0408f04bbfae71

SHA256
98d9e2416c970587c44665d369f29fdaf7cea6afda69f0f7aebe87eb7626ba4c

SHA512
de92ad5e22e3fc23654baa9a8f476f05eb9472892dcf85f32d3a9f5e8cc5cb927ffa28b50ab9da42e1212ce69b3985dfba31627e6e0f45dc355c6a2679e2d204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c307b02b4dcc58c_0

Filesize
24KB

MD5
ce3b6a27d3165badb1df3ec0b9590379

SHA1
42438061cc8c2b35c02cd75ad45f47822a2ce7d8

SHA256
2fe55d1afdbef899297ea19199642e960654d9a998c953c47a9c02ffd14aeed6

SHA512
1dd1bf6da8150b6a567a6207e4048f5999c7b0cc08ce02c6a8b4ff5d422c7660ade2d25ec44c56866d088bdff75c7dd5fac352e47a70da6354cc95458a799f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56dd9c6c20b3abc1_0

Filesize
371KB

MD5
5eb2edebd55fb42da23e15141a99c049

SHA1
5371d91c750af5971e2e237134ffa627724687aa

SHA256
a511146c6bf4eea723ebc1bad1507e3324c9e08126656652a465b289cd6b7bc2

SHA512
f2e7a70f08127f4a77b21e7dbad9ca6b101ad01427fd6cc8014e668d5941d7ce831c0a4b24ee3d82117781ad667a54386fe4d97c96221a51537780ed13f0e6a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a910035292016a9_0

Filesize
19KB

MD5
0beff1de3f661f2be7864a563970f974

SHA1
6de86598281ea3bb9c88964b40981fe20591674c

SHA256
7da5125bd17f453ba7a3d4010c827cac0a3e385b1525f96bd382ca7fade54243

SHA512
aee61b60fefe9db0a08df98821ff97babab28e8aaefb5bd15a78231d61fbc7067e1dd31463dea37135c581d4bac8f5b8ac45cf9ba6b9c17f7e12cd1e78e9d64a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7ad54035ebb7c1e9_0

Filesize
330KB

MD5
59ab3c5a8c17bcc5d7965aa63ed9fd63

SHA1
de1af6b38375c1041f763cc772ab01cc436a8b6b

SHA256
73409f4b770e593aff8d507084d2fbe168d0cc4b7fe38afe3c0884ef220461d2

SHA512
2b09b2733bd0e6e6fe2d2c2d71b115a2e8c780aded85f02373045d3ee8eeb4a4492b60d15c53c1f399afcadf0ac0179d596d871f2ecc81d3778a2152cebfd007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\990918310a541bfa_0

Filesize
373KB

MD5
b08b17f4bddc7bce7023663ee30b5444

SHA1
21f184bbccead476c87dd2c120e6e51af7bb2b9c

SHA256
1646a438ee5da53de9bc3113ca14628e09b9a169316ce011d80390cc0221033f

SHA512
51c8cbda1df7b09fe17bf003b43615065ec467a0977187e871e9c061dce12b38f18ed910de4cb971b680286c5601a6ec10985385eefdf40f961e834f33e8af0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d782f305bb50c377_0

Filesize
300B

MD5
d46906db87d6ae1cf0a9b8e70dac99c2

SHA1
85ea0571eee4f7dab8f64a0b598d98e250feeb5f

SHA256
e1ab808c0de3455052497b31af6240f57fb0820ad8ac4c71e278921b2c5258f8

SHA512
c537f51613b5f81b9a94fd6a79ef12e5c8165d9f7f7740bc1502054b65f38993142d70f07d60696b59f05baf83acb14556aa30764aa0db64c5c43bc042aa1527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e549bc56cb768005_0

Filesize
32KB

MD5
85adf75c8611826f23d47c812fcd8783

SHA1
aaefce900a5a30981c0fd80bba016017865b3390

SHA256
547e35cd78368d1586f7e69f9c80ae62a04819c3980b00cde4f7acc9b03aec17

SHA512
a05cb9464699cbe2d771e92eaf0e771ccc651a91d3f857eef50e494c7d660c822cbcd4fa96e780651a56c42bbe6d121b55fd707080b7a1c29840609f18c7de6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ea9b8918ad020319_0

Filesize
289B

MD5
9b2b4d80339f49b674a76ccad18da840

SHA1
8f09191080473af6009e6534c34b360168f3d443

SHA256
086013e497913b137195666e7eafb417d7972987fd5b8b9b4693dc4841409b31

SHA512
c2bfe8f76736d2423abd110d034c09d363f2c050c1095517286a7f96afee0900a981a482e03fc37fc1ffcc9ee1e1194c77c1958f6e5b78789e414c21ac695cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
9c5f741a11c5ff60697d996e64bc211c

SHA1
51175593c79ac3b9b58cfa76a81f3651a740bf95

SHA256
0d5d2d8fb639ad88baee9e232523e3f8a5e1092f41fb9741b95832204dac1d4d

SHA512
6a5522878917e196cee49ab14de0dc6fc42d1492bb3acf34a687ddc011c5eab57ad08d635add3d34ad731611f38d068eb2c47607de21f4bee4abf830038fe6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
bcc1e495c14e04ece22129b6b84b8d8b

SHA1
fa0c92f12256abab36e25fe1f5239ccca2229a1a

SHA256
860ad1a7d123b436f85f2f60225535da6978fe2fd7f7ac40f9292f7cc2bb144b

SHA512
4090509b8cebdbe4a6a21fc750a4e401bc6f11d1ca41310bd3b2249d19c92a491b691eacbc3beae1cc4c206bb358242f758991906abe0c0a457cf250c1cad46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
e849429a39e9d5fffd169beaec85c140

SHA1
acd5183db28a9b1172ef26fafae525de292660bd

SHA256
759e00e1a8fe4489f47f57fb95c8551a6c76448f4c5fa86c1601d97208e9a7d1

SHA512
85f3a5f942f843809bcc3e6e88e40ef96d0841db71a871a01c77b5b24f1bd555e1e42e4b849d9419976ea47fbe5d214c4a9de26038f7f6886be1f2d78d347114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
ab8917c232989b73a5482709e285bd2f

SHA1
69011dde3d03c8395acfd21b941274ebb6667a38

SHA256
4aeaec1ec23f3cab28ccc10a2703b5e99710c6879365aa9456c076c4b7cbae9b

SHA512
5a33d6cb0aefb3ec1390b4d057685b1f7d2122da281ec1c97b17188e8fa1409c34ab0e47c40498ce2fa7aef5b8d89f313841ee0973aba3891ff1d2edb20e17c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.gamepur.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.gamepur.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
5d4c00908eef41f8c2a658e1445a4eb3

SHA1
a5c5e1d3ce55354d14f15cd19b430d9a9bf4d277

SHA256
0d7406fb90e1fcb0e37b3c5a1144263a7c684d79b4cfcd4e1de570be2727adda

SHA512
08ae05bed1f908fd41295cc3d643cb05ca3f431468a198e5e54e3ac1936fd139be216ff7e220064daed9300b992a2ee30f2b8cf4518dae367eb40ff33ea5ce6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
555884ed419a75fef8f1caafe129ae77

SHA1
0f47846f9a4f9432f4d367f262571a33b161f474

SHA256
cbdac83b00a7073b2cbcb25f6bd0918fcd9a94b1e898acbccb26dfeecc493c9b

SHA512
6348eb8663a95133706bc97003bdc50e0cd08aff8f399c1cae72b92ef2b2ff5477c185441ee6a82b1ac0a23b025a5e046f6ba448b3cf8d58d451d203d6b7cbd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
560ea5b114e7aac745681285e32738e2

SHA1
dbc79edfb85d08973f7a5396b9ca0d6403c2d3b1

SHA256
22efe4e3ca78425337473fe6b30ac4380227fcf1ab72aa58cc17839f1ab42249

SHA512
39e795570be0d1e7f5fd78246258ad0b33e92169e23c05d663dd396e33e5f486c2a9a6d7499966df83dd3d01886c3241e941c4ccaf00c9bfa1318ed9837e00b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
179dd4412cf2dd9deb233b6e27885178

SHA1
90bd5d602f3d13de534b4769c5b7b166dbb9cea2

SHA256
04855be2dc1bbee0f4377ce58cdc1cfcb5c8cc79f88d52a9768ebaf85280b34e

SHA512
c0a55e68cf146c3528bafb6823d0a5b6fcf6d1518d21df4952f04d67a4ee713a19fb2c1f2f026c47d1ac7cc837f9223a92151e2cb4c4c48ac3704bc9bb445582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
67bf38400a911a35167fa2b883fe6646

SHA1
bcf4e03a28dc03669f743f2b4348b0adc6910ce4

SHA256
36918d83d73c2f89da4f7bf5ea32270356862d9e8e0645ffe25519a6472c7fed

SHA512
0aeedf985b6663e7cac1d2bfc0f7173d8c636a816c81c1e91d762a9d120902ba8ad4d2a58fdba6e0329a12836c653d3e9bd3b01061a67d86dae8d408dabd5919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
23KB

MD5
9ae8303062cae23f3414257ecbbd045d

SHA1
e78b38c44a353d1d241dccac24b62b64e44efeb1

SHA256
fd4907aa0f1f75d1f51b1752a72300447e203cc0f910892c0922a455b2e78358

SHA512
e82d1d390f4ad9d4417a8da0e6844393a9ef7dac3bc1d4f15ea6fe6460c114dc9a0a3f280dede3f113e81b60d4702fc619417f361cd42e0b1c83f9eeee9ac36c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
dac36c1cd13566443121e71303649c49

SHA1
f1c6b60a0ab5ce5ec65c583f458171ba45815756

SHA256
cf5c6d0a7b5ae5c0489c7586bab6c47e576e0785787d8e4ffebcd50c2901ff0a

SHA512
23b05cae936900e0fca7bc2d109e2a2139dc38de581425f862ca3b0f423b4f4b423f0a0259fff1a05dd272ea1e5d494709d7bb7a9860bb2595e105ea90e64639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
46d7eaa312fc9f4d265fcdf00a88f9d8

SHA1
51e639f9d4408f77e83f491052d89de718447096

SHA256
598d90db95ed684be8d3fe3dc787a9ba220cf3dcfaa231dfe3bdf384ebeeee2f

SHA512
5defcb8fce12678bb6c90d4c48572fef88882a9900ad40c2a9555b508f73a57c52fb965a33818ee88014ab903775dbd715addb3d8efae74262fd93a6bd571a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9b4118d6583c2c37b6da110bc2cffb28

SHA1
0a606a25520e33df0cf0676c4ab26944e4e2cdc7

SHA256
8670693dc5f25653736462896210991114d851b31471a00b1af03a13ccedcc80

SHA512
030beb6938c67cb24973deaccc73ad5d1a66647bae8377eee6e497a54446f9257f9d69e21fb2585510156a103d791eb0f993eee326a5446f12a7dd85f62b0f5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
d4d3e27b3fd5daf51192e87eab98c77f

SHA1
bf3f02008e1322b60f56db8c9b1e194f398fa76a

SHA256
b84a1d5fd7151f7944110d2362137496618114eca60dbf46f9c370123a7718c5

SHA512
dc5865607550f3c3c968a5b09b6aee3938c6e71fb41697549fd1fba008f9069fac4fe02f8b8174f73c95b225d262652446dd9632f7db0f27d34d6e420aa086a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c0abcaaecd60408300d7fb8638fd3f40

SHA1
9867d9c3ae2cf014472dd648d552fa4b5ee99ea8

SHA256
c3d247f39d117f8accdaf77e1d59bf4b707ccc530993fd30f1c4ab9a1fedd5d2

SHA512
13681ea95c30801ae92873804a8995dfcf58ade14432b414175a3bb5fcb97db5cf4882021185a56ad4165a4ef89efeb5e90bd0094fb0b8f8d9d39a3afb852f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
f65064183e2288f0837359645f106367

SHA1
e1ce4b02ad9a26352fd04bef757d456ace3d33e1

SHA256
b0ae38b1ef7d82b6895486224f04d682b7bb59de593faa31a0719a2cdc61e515

SHA512
958b93642942aec737ef28382b7accd902e0e14e407183e0ec3f9013033a476be98daca78f887d8b13ad11279d40b0e18338486740b6a6f135b22c3e1084c160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
ed1aca35e4c54a92966956eee7e59d2e

SHA1
6e605adcf24ee9035873f75739d3733c8c6081ff

SHA256
1d3550ae71925c3d459f271a6ffca65b519a96910c51f3aee513fa6f2f4e119b

SHA512
1b51608320a708bc770309f4858acbe3ae79f6311145b2539676b6ab152afa73934e82a7486a0e4a95f8524c89caa0b09a8123ef3dbb9ea7f319d9224748f0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
2e827260016f2ca3725c908acaf95c06

SHA1
a03c0d23c8e402b441cc797ba37901c1c2979c40

SHA256
5d0eababc8cee26d6bc67954962ee51c23925c849dc0066e77af63ef6b703a1a

SHA512
b6acefa0e20a02152fc8de0354e3516c4b084cc0d434aaaf758d59b101658c926f719b2cbb98a651947e0826bf0d75df8ef4d21792e4d7404e12f94d7f12b279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
9be9241e7b6f5d801c82209543e043a8

SHA1
ff9cf28f5e3df18c172435185ef51851180052b9

SHA256
03714121d8dfe50f6ec9aaaade69df41da5baa31f8ad03d52b9508dd05ab50f8

SHA512
8bf443d62e507618cc41abf18d8e74ed314956bfbd1955258c6e21b95cb67cbe7e29a8bfae768f640cbc156942ecf9b381124e49f6bc897792df972cab34d6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
bb0f4154ae9d224a38211587a96d65c8

SHA1
d13417bb31441587e64b6a83f18150a008ee8373

SHA256
ce66ba91d90b6991d976fde8ab8e51bda498a21496c553e2a28e05a5bcde0c05

SHA512
7b975c6f6f9d2155754ab6fec72aa6d50b546576eecb0e3649ba7d49553e726735caf36de03b1c2423306f79b1e25077c4aa2b80674139aa073a74ab8dbc7494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
10KB

MD5
0c5bf78eb1f0b8f5f8a623e0b741fd8d

SHA1
7cfd41b183a7b5a63b9522f1e4a2189da1a7e8d5

SHA256
3a86a387f34c93d48140cb32963d03cbc7983cf447be1c777511b6c2972589c6

SHA512
ac17eed7f0140ef784a74b6d4b05fb1ae8446544b57aba913423a96a1490dbc0038f98501253dbf9a4384f0ca46ca67277f18fa6f3c5a7a979650dbc152c5471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
7c8379b0a1e64d900d63918c8b884053

SHA1
1754059fa90c03e9dfd0b5bc35d6740783d7c592

SHA256
267802fe1fec4d65c20bd69067976fb5221214288a6cd5e6e20f4c0ded14406c

SHA512
b7150f3f128d529596fa33048a909e1df4923c5c339df1cde85f95acf2a61dd33fc434dadce4c6192285d84c78b7d1bbffb3faf45036f1cb3015dfef2d3b6012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
a54fbd09cf67dfc1f8190eef53a0170a

SHA1
e8b1ba44d702a65c5d5791ae3ec891b2e35f1ce8

SHA256
2e91a4f132ae08f396da63f1d1a15e5010710032a7a2f7f77238cd01747e2362

SHA512
6917573ec1f4598dc217d6af95af2e4c2ed44091886431e873f0c1067bdbb61b8ed686950bf10750155c5c2eedaf3c42726caabc94ae875387f69e8b40c0debe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
821781436bbba4aff587b6cd4fec9d95

SHA1
9dad45214f25dc3a45d842aeae76a80e3d71a79c

SHA256
9c74efa35edd591b84b7fb3d23a4a3c64bc1d93f217c0ddab1aa4a957dd8f187

SHA512
b7b74bd4366696ab1d4be00d17624c33065d22c7b0360782ffb723cb3db8e97efd183c7ee83f472f9ec0b9b1338f8850e016a9990606fc70c561456c54be0349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f7fd56c52f40e65e47bb36394ab8301

SHA1
45da1d3a571136b479a507b07dababeab0fd2b15

SHA256
1496ac05623f277897a7c0f9197a97e30ac0dcc1ee5e874018baa13fdc07f1b8

SHA512
6726c8d63299ce35bc053fe37986fb49ba5f387d96c2fe5a3b8911851d4efe65efd7e19067e2f0e8907bf8fe147deb761dae28ba62d288b17aae79bb420a2927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
6ad7125577b426b1c8e765fc693c09fe

SHA1
8e74b891cd1a0aa0d88999d6f903454ca782d42e

SHA256
9d4e5de9a184bce433c09482ad901865f8b8983efa8be5f546cd6aa86686a0c4

SHA512
de14e91e4872bc8be7775e028c616fb84e7714cfc325b7dcebe8777f91a2e009c2b312b194e78dc1949f71bd3612e9e26e903867fd43c820bbf0fcaee0a4ad22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dbc9.TMP

Filesize
1KB

MD5
de2f735f2096ad07443e27a46e8cdec9

SHA1
a090065c60f0ca9d7dce7c4e30183352ceb7efb8

SHA256
7f937fdd97239f514dfee8ca9fd3179f53f4a6d66a927cf4c44c3361bc225e25

SHA512
0018a95164ca0310555c1d68db49df91f004b2c0602ede6e06ac30a00fd124564c2170887d9a10cf5378dbe1744be8a931f0383cd2dd8d54387f53a6fcccff37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e35e50011d0cfe3f8e78079b89b233ea

SHA1
235f0697e870757afb42da1ae2b146715377fa6c

SHA256
a815308db8239b04aa071f44199d0de334617a4c17eb256d974d4ffd173231e3

SHA512
9bd559ef439a24ee66fd1dd26735f6e3307f3149ebc646bc928de01f5b52820c520ac3da9cb143f7df458d6c946b0b9baa11673f63a599647d045c03c4357ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f0756b6e4c433ecea1d6b57a568dd215

SHA1
2bc9ba7efa329a97999aa1631d75d7b39a21effe

SHA256
963f918723b960a6fc02ce820515893b069b7dc9a1f3a76fc8636fe0d4b2afa0

SHA512
c4e8388a81f6c903a5970a0869b496720532ad0da7d26eabcd27020c275ab5d26f11e1344c5bb3925a8fe1b0d403d5fcaaa1d34830b81184fd70de21e70dd560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
602c1e52f328e2a901f380a93d8a286f

SHA1
f1c74c0248454f34a30fb273a849fc17b85fe092

SHA256
199e508f1bd15ac709b2348d1fb6ddb12d01c8ec57979b1fceee8f448a53f8f5

SHA512
1f985a6be671a44ca2bf91a99fe000180d6828b2abe80e1972059146dac0cddd310226e9f6cb0dc3cf671c1dd7a59c2d7f73b640da6b8f863fcf1963be34edf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e265649c6860cb74f21565d5673b307d

SHA1
ba1c6e862638180f1243d1573d0cb8f801f84ca4

SHA256
e98a4a1043d38d148712e1c2566389ec2069defda0563998ff46233a81cac2e1

SHA512
0602c6d83302631dfa1febe856057323da72d243f96e131d200b47dfbdf8f55d2cf6e8a5443bb23c4082a365ca6770a20f6abe57f405bff5fb4929b4c41bda33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
17e8d436c834a2caa659c78b1c1f19fb

SHA1
4b0adcd0704e74ebbf4f5316060d5c8c59d08994

SHA256
e5373811971330dd825cecdeb83567f87eae47cc6630af88b0b85638883cb656

SHA512
f35917b8103f385de50bda1a60b05b6099259b96f50d68275688d53eca5bb2566e0517db4f5f23b659a69a38135f4763bf35b8d4f22f6dc9488dff9c722c97b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
27155924dda678c9c191c6055ec83710

SHA1
5d12383670459af471ff9437766fdd0073581379

SHA256
f877c6138d412fad0591353c0900f51469849ce7cc6b99c53a4bb13b54074036

SHA512
f8a787d5221f9783e983b14d58d4bd087604c44e3b7b8939d759335a0b09ac6e66de195b05f9d9e5c459fb4adcd3eb23497d57e33e02466ae52ddb19d9f81f59

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
2c349f7892543300a200d514050940a7

SHA1
19a202f88c7a5a80cf0f45f5740f092b4c87b4ed

SHA256
4e5d4f8fc10c06b353722b92044d8bc3ac663414cc4663813f3db57869b4bd19

SHA512
f62f3582be40cb99ea717918b69bf8580772b0810dad9b26e84b13892ab0f48c5e1ea441e7fe500a6ae13aa6bc56d23305190b7b8699b466ec7d1da85b4d4e1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
525b78c5360ce591752599f1d5a69018

SHA1
7bf7cc6561b9c36182397be2532892e933c9cd92

SHA256
aaa68372d59a30524dd51e197dc3fbe18ce75e85a4a0f8a81b1ab3cdc5f44c24

SHA512
3f76daf3cb7e4265c5a5a1831c4eb5a5d3fd19de94c9724bf2bd7372800816085c20426b542b70ad8e98f11c9e54f5dcb8afe60ce0b4c211bc50240979e1b66b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7d4566eb8ac47e36c9bed0ed5ebe4c73

SHA1
94f47927a1f1afd815420fbe59c782f1adc6ae60

SHA256
2745968d89e877b22100996cac4d3b1ffd28869560420f5b822f0b4c6543cb1f

SHA512
5bfb09ea063b245ae88276cef0cad4ac41ea67b1aeade07dc586393a71673bf0e06ba87cfa7e7af13a863a5f4adee3e1df277806564e92c958f21b47691fd988

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
135ec1729e5d5d6928c66a6e2b2d89e1

SHA1
9c32420b16dec01c41c81ddddfb8940f7141e9e4

SHA256
43366370dcce80d43479cc052025f26124cb2063466c3cdaa80cda8365e4e358

SHA512
545a4ca81f0e6b8de70fa47cfcd691c8b2ef1bfa3fc1456efd7902ffa31ca1a68b9a2333687bcb622578371b70d4e030523c717529b0301dbb6d2a9ba6fa14a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
40ef3ed2fcbfbdb5032a6736a3b59dfd

SHA1
d64ca608256e894c6cf70da319744d85dbb24c91

SHA256
089a6273365e82460ca6639c4b10492d0ab176f7dcd4b79646e4040de4c0d49c

SHA512
ee5b58daa0a76d5b4f80deac9be7a0fdc9e6d0dfe12f98a964a1e1f6112560d6c61f8ca60dbd43e0f144e6403c6db61c2b81ab4cc54ac3a3fc7b35cf8071e696

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 839175.crdownload

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit