targetcompany | aca683c066dd7911dc5f31f97a600a52a207ea37c1414f759ef18975e273db03

Resubmissions

21/08/2024, 08:43

240821-km338syhma 10

11/06/2024, 10:51

240611-mx91msthkh 10

Analysis

max time kernel
171s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Size

6.1MB
MD5

e841da9fde650a64ba943664e6ab8dac
SHA1

9ccb6b2be009e6839fef5f704ce000f3eecf0592
SHA256

aca683c066dd7911dc5f31f97a600a52a207ea37c1414f759ef18975e273db03
SHA512

4aff1460df3110de19d2f5605620b702c3f28e381b31dc5210a518598e7fecd980c35a7df36cb71cc08020760eb6e89c5922a0b9ee34420d6681a1ee371d4b22
SSDEEP

49152:d6B5w3LVcmVooH3wH7nW9n95hWQJpUU3Lj4CtoX7t7uwPuo4Lk7BP9tYIFVVMTWr:I5yEg38oLrQlr7JGTW0TO4HWDq2EO

Score

10^/10

targetcompany discovery evasion motw phishing ransomware

Malware Config

Extracted

Path

\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Family

targetcompany

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 8CF42E5882B69EBB55277CE6 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.�

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1092	bcdedit.exe
1888	bcdedit.exe

Renames multiple (6498) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\O:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\Q:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\U:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\D:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\E:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\J:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\L:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\Y:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\S:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\T:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\X:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\A:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\H:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\I:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\P:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\G:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\K:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\W:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\Z:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\B:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\M:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\R:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened (read-only)	\??\V:	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
150	whatismyipaddress.com
9	api.ipify.org
129	whatismyipaddress.com
130	whatismyipaddress.com
131	whatismyipaddress.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
620	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	131	https://whatismyipaddress.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8b695a6b1d8a3d8e	3

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-125.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-100.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.winmd	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-black.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\holiday_weather.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-150.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\SphereVertexShader.cso	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\weather_2_travel.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxManifest.xml	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\SkypeAssets-Light.ttf	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\content-types.properties	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_HotelReservation_Light.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\SplashScreen.scale-200.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookMedTile.scale-200.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\SuperSlowMotionCheckbox.xbf	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80_altform-lightunplated.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xee27.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\ui-strings.js	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\bun.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-200.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\ui-strings.js	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h2x.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ExtendedSplashScreen.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-125.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ro_get.svg	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-24.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-150.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Images\dash.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-200_contrast-white.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_2x.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\ui-strings.js	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\comment.svg	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.825b23de.pri	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\HOW TO BACK FILES.txt	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1712	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{C5BE9DA2-9D0E-47A7-93D6-533FA2143674}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
6192	msedge.exe
6192	msedge.exe
2464	msedge.exe
2464	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
5536	msedge.exe
5536	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeDebugPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
Token: SeTakeOwnershipPrivilege	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 2128	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe	86
PID 3236 wrote to memory of 2128	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe	86
PID 3236 wrote to memory of 2732	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe	88
PID 3236 wrote to memory of 2732	3236	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe	88
PID 2128 wrote to memory of 1092	2128	cmd.exe	90
PID 2128 wrote to memory of 1092	2128	cmd.exe	90
PID 2732 wrote to memory of 1888	2732	cmd.exe	93
PID 2732 wrote to memory of 1888	2732	cmd.exe	93
PID 2464 wrote to memory of 1328	2464	msedge.exe	105
PID 2464 wrote to memory of 1328	2464	msedge.exe	105
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6112	2464	msedge.exe	106
PID 2464 wrote to memory of 6192	2464	msedge.exe	107
PID 2464 wrote to memory of 6192	2464	msedge.exe	107
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108
PID 2464 wrote to memory of 3160	2464	msedge.exe	108

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-11_e841da9fde650a64ba943664e6ab8dac_gazer_ryuk.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffad8a746f8,0x7ffad8a74708,0x7ffad8a74718
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:7064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:6868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1404 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:6532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:6316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:6844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8384 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8432 /prefetch:1
  2⤵
  PID:6204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9292 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9592 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9712 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10052 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8832 /prefetch:1
  2⤵
  PID:6436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10244 /prefetch:1
  2⤵
  PID:7104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8960 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9936 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10532 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10576 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9940 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9724 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5818141614615529702,17439116287670004177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10896 /prefetch:1
  2⤵
  PID:1876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:844
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66ACDE50-48C.pma.rmallox

Filesize
4.0MB

MD5
bc1ad191fcb268024336cb682ab4433c

SHA1
d1a4ab89b7fd57ebd86e46db5599af581fab945b

SHA256
6763021d601f1adb3a9bb57b53cd2d769b84667db3cf66fe5531e109e4702c22

SHA512
42ee38d3e64be427bbd70be18e3a6b54e9378139ac7dc2b1c6a43c5537f3570df4835132f1ffce6c3d5878bf3ccdc0b56df7fc1bdb1e1348118e4cdda34eff9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
80df7a2ffbe4d7c951440e7eaded0860

SHA1
bb7bb4b12a5569e1aa2ff3de3ba0602cb46c7b55

SHA256
0d8a3a0206f506c1d0ed323abc1e44e1eed354ff829139d0a6d7e9cd09e5966c

SHA512
da6f5365d8ffa85235e16e65f0c34e20146b6d1afa94a078f59fa14f48df59fef4ac03aa1c0b14d8c0b28367c5a00f6277c4dcfaf8d278dfb971db0a227d2e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dd6e5dac2c92d1b02c90870f1d2c99ea

SHA1
e5cda99d5604cf1a89fb1dfd32ec7b24bdcdc79a

SHA256
b06b6e315377684850be4380d6bba66eb425c5ff0331f30bd6444526221b4a02

SHA512
0bcf25766c0a2d015a45a2be8346c307e7f40c093df6ec0694c01d9973056ed7496d3e8703d1c824ba9b1c9ec61f21edcc81fecf3bd8fb3f03fb09ac6b7c0416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b63742f6e61f5119fd8373112492e917

SHA1
767a68385468f73b7c70d691c22bb90d29237278

SHA256
81a2b6a853575c13cb0033299fbc624dfa02ef78b144b04290ef7c37f0bb1db2

SHA512
9d77467d16487d7ca8e25591b19338ce5d35ef787599f308a1db71596e5875d5b344915ed341b677f5195fe595812efa5412490946fc0a09ec3133cafac6e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40c29afb-7729-4e5c-82ec-ce0722223e42.tmp

Filesize
4KB

MD5
fe3059bf0f97f88d4ad8bdefc5e18c32

SHA1
927ddbb3709ff02db8c21d862b17c568f488e171

SHA256
6b17d4ad6dc9c38949822ed5a623130fff3cd7fc8e0599ea4ae7f398e77c4ff0

SHA512
775d1454240ad1dc97b8049e1b9eac493206255de071cd2196d3ec79cc6e6d4f86a945a338afd67768ac9dfe686a2c3f6dbfbe4b4b268f15030ba60501260c03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
67KB

MD5
4bb360ae7e6ad48f41e6e661dc509bc9

SHA1
e6b8d6b2466d7c701dd2a651d7336a41c079d998

SHA256
39d340184c17611060bc98bdb9e79f805a4ac94299a957850e25a709c50236b3

SHA512
adce176f426c1e1908bb707d3a608bbaa40fbbf69bf0d104bf3f0db0b2f567cc4e5ecb274459023b1918d93df6a4a78198308f3de609c73b006ced2e280ee56b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
43KB

MD5
e352d970a4f70796e375f56686933101

SHA1
20638161142277687374c446440c3239840362b4

SHA256
8a346ccc26d3ae6ded2665b27b443d6f17580650d3fdd44ef1bb6305bee37d52

SHA512
b2c95bc6a7bd4cc5ef1d7ea17d839219a1aa5eba6baeb5eab6a57ec0a7adbc341eb7c4d328bcc03476d73fd4d70f3a4bdec471a22f9eb3e42eb2cae94eeb1ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
1.2MB

MD5
ae79a3e945e45f571fdf9ab94bcab4ee

SHA1
eac343e9f3660f78ea5e2f1bd634c8123f207642

SHA256
039c61c90725ad5a7422c5f00cc6d85ff2c57e3f7697b75ec57668e62fc209f7

SHA512
0bfd27261eae0cc6462b71fce73461639fd1b6071797b29e047b16940ce25e79bb50032c289401fef4a10d22f0b1afd801dc9d29e0dbc085486d5fdeb88cb814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
75e63267e0b25b48a7abb8e5eed284f1

SHA1
80f02dd5e10c665e1c331ba102470d59494eaa32

SHA256
6b94e0758f410092beddc34ce4a0561389f5e402281150207ccf3ee5655b549a

SHA512
b776214715ddc58a4d61c3c872787f163b45efa551b18598fd0c3771feba1fe7aa8b7e5251f35e616368af769f883ac8ea5a5cb38d76c9d4e03dabdb8331023a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
69f99b6731f850d0ad0a32bf12119c48

SHA1
061344fb4af1656e47c0c78a3eface3868a18a05

SHA256
856284b12e09060c3e59fdf9f0471d132b59d2bdae2f6bc24c7448ee34560dc0

SHA512
0f932e954a36189cf8554a29b94887ff201514c2891e736eedfa41e2a488fdd780be8c0eed7bcbf91c7b999487da4644175f8c2350d04276d90ad2a4ecc04c32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
dc851649dc1350b596f0a29dd84c1ca8

SHA1
f28bc6901cdb3977bd7402623866ee90d1853c4f

SHA256
da8f3ea1dec0c653b2403900044068e68c76ab8552bce0f9b53fdfad49f7f6b8

SHA512
0cfee3a35ea20e6eb5f5d341be99801f4dcbdbeb0b52fcab02a6df3a89163df0386a0eccd0732374b01bb8ea804b89bf1a070804da012b5269d22e63ba883d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3671e5cf4f42b6a9d59bd14170ccb9f1

SHA1
e8947be3ba0fc5eeb7c0bf1539415e04da2cd72e

SHA256
14774285ff3a30ee74d7ad044efa34988745f0004cb16b413ae2a65ae0a66ba5

SHA512
7430ee2b1af064842e70c74c8355cac5409c00042df34e84c84aec9a7357930dde5a5b8f6442e28cd9f6315f691dc2b447792bf28575a3815c8d042cf22b80b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
59B

MD5
78bfcecb05ed1904edce3b60cb5c7e62

SHA1
bf77a7461de9d41d12aa88fba056ba758793d9ce

SHA256
c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

SHA512
2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
823B

MD5
8a086661213129d8e1203c536438d502

SHA1
892001b707aee725d0e59b562e5fcfedb99f4a04

SHA256
154b83b001cd77307e49bfe4244e74b55478fe70425b79432d07ceea8c2a1914

SHA512
764da89939a78fecdfd2a2967eb411b64067a38ee4cd0e6618e60c66acd3eb0ecbde154ced389c20a0fe8f9fc8819dcda47b652d8e440d9c91f0df5bd271551d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af3124e9e3a376fe2ace435c1f5570da

SHA1
75775745d5d8b560956cebcb684b313b7ce8dea2

SHA256
b127590746acf951ec9db6afe6527aed2c9b7fb9aff6e25b09a38b421c0b0373

SHA512
cec3ad20be40fb5fd882ee847eb1418afb2a6b5f4849477cef31d3c6fa4a3699bfa991d6dd46ab6822b579eb048293fb368a254398dfe4957baac350eb37ac8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eead036bdf9fab4f9d9c985142826251

SHA1
1c08db3508402a7b109b9f5d6d972ae451fef8ca

SHA256
85f149422d63a477636354fc1c2e0c525a7132191bed9f35c050362cfdb6a4ed

SHA512
47a7941ecbfab3867cfdc4e1649b765a758ee6a006a8d95e3e5623b30ea2150fcad2730a5930f6bda5630250a16d94b2508c8a1b7f2b474e4a2b213eb8816a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73dc0ef5329888e1398c0e4734541671

SHA1
7719b29d4a200b1c583b27bac6350453adc4e35f

SHA256
d8393bf13e6620a42fc4c88bdcbed8861db0f95bf48673c22f112f49db301f92

SHA512
bdc9a41a31f0f72b56af7d739289fda356c2c14da530588952537b77ddf18eca4669cdad172469ef91d298c6a7664a7e798d4a6d2e00d7a1b6b92fd1bc309cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f86240471c04dda635468f696bcac1e

SHA1
89a5b071a7f1d5017d2d26ecfc4e56d7619e568e

SHA256
68360532bdd1397a97d930ed5a2966bf621d1f1ecb13b8e66792c2fcedce50bf

SHA512
3ef6d88656ec533cc00950d3d7d6bacd5ebbef2ba6e1306e0a0aac884200f49d5a2719073ba69fa22c57f8acad93c705b5dfa60bd224bd31841ee11f67699f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf64ee0e852f41448403c90a2163f86d

SHA1
92868be8952cf87995b2a1f6416e7972307451dd

SHA256
d182768fe01b166205e3728e632576441b7d56e1879eede541b098631d8fc61a

SHA512
44120785b5e55fd9314bdf9b43c8847d3b47c35f4a3195a5f0242c534363626375ec9212ede329dad723fce35245b90b79c84ffa40ba4e1dabed543530559761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65ea28e123764affd9be96b4cbab0824

SHA1
32e8cd45326375dca1b8aff23742421b0d5e382e

SHA256
9d735c5580f223e196b4e3060e17d97cb7ee2e51ff082b81e93a43fa33bf7b61

SHA512
378679929ded98dacc430800c3b1cce0247d79efa94c600dd526964d2030ce77454b1612a8f4109ace560bbee3d41b63ce7573015d281942c8d86b2f6858d958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d54c8a2d54f5fe7e2149fe261da9ee8c

SHA1
5dd2a2ac3cc85abf85d3336348ad758eef5adfd3

SHA256
d72d7be9f31c62a273d2cb99e0ad91987b1a155144286785b07d5b0539961d2f

SHA512
aa6c498b9a7d7cdcb44da8bb25e3d928663400381c79f9ac4b721891a26d688460fe31af59f97535f34d6f6467571ea078a862eb8e219ea890e5cb6d068aa96c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe583a06.TMP

Filesize
24KB

MD5
fad58094148f655631edb3e951f84e6f

SHA1
9094cc42383162f8e5850d7d79daeb2c66dc9eee

SHA256
b94b0b66689f74da19a2ecc59ee39f10baf98b66153968f64924968914fe4f46

SHA512
fcc98d4abadcc063a6bbe1836c033edb771286b6a0fbe06ee39a024dd35ac8da50500e2d1f789efd9a5054b8b45c6aed8873b396bb6aa0b67582393fb8243366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
22f72cf0e7fb8d4a006243aeffb50b29

SHA1
a290ad34459f9d10ab1512323e68a8d584df895b

SHA256
b103641cbebc8a5cbecfc3e96f66e6f3a88b03aaf73a74dbc2edb2f680112829

SHA512
1a1973c5a385dc43f12dbc2787d36f3e6fc6481289df253f5fbb260609e095c0671ab64c02fc627aeb06d7b564b975ff575740e28f8de9be51a33b5790e14f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b80a55deb3293134ac93ca6c3c5db47a

SHA1
ed29d03df69336cdb3e603bd87d8591c845a8afc

SHA256
e5d834b3de6c971c1728b30e030c8ab8630802b326fe41e343ba8de71b8c08ab

SHA512
d7271d197f525d1a0280c7c0e59ae554982f306bbed7bd6086545aa1448c4751dcec8b57e980b8ab26640c28df56b4dd357e9f9f0f6d19254dc4923d0cc62b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a109b.TMP

Filesize
538B

MD5
55d22c76f37c6946ac87c1f1741de239

SHA1
d629ff9bd9636f2df2cd2fe681fb686ccb5d44bd

SHA256
0c5b027d30fb7a41b991dad9512dc199b98bd40093c3bd63a20932edf56959d5

SHA512
9583a5c813e37c67f1b69ec63b5fffb268e0b065642e17d092e1db90ba59213e0645eed94dd118cb68aea09f7e21b3b3c8db98eeee48cde7bc39bd2464af4739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
848158445cc462a674bca7d5613a1895

SHA1
b822a02ea79cbf1c201f05d7d958c1c0f67cc51e

SHA256
d0b8c8193e7f59121944d1d9a9ff11e062eb99526b27e19629c29ab6b46f71db

SHA512
2b5d8a524c2fb0a3e29b28e46de00e5c85f8f0a9cee895f7f8c557ec285c434f10e8821ec6d0279f5a8116769caf93d1c2ac6de57710e99f8ba7424341cca712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State~RFe584bba.TMP

Filesize
9KB

MD5
edaee6e021ac2f3323b7ba653f91a164

SHA1
77a6c6227029da2b32f055ef469f6a49665c5888

SHA256
80ac3047becd3fea4eb9b73582e192e5cf494ed103008c2b083f0e0809504fc7

SHA512
803df1ea3116f3396b225ccb9261022bc6531b15f27e64a8e6d4eeb3f343c4b56541429c3a8d08ffeea618b452689c6f553c0a55c8df1334b8295a5c43df1cd1

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
260B

MD5
5f96a6c7d09cfd175537a28755734858

SHA1
279512d4bdb8764150092dc3db87e1015e714191

SHA256
136cef11c5ce237195c2200da27ce7e717fa7eb02442d7248482f4ff2c1c90af

SHA512
3ff3c17d92093338d1ffa75a3a550d174d2eb839a4b21753720b022c8f8ea979ce9d49ee2e89041bd0660a49fc4a5bbae00b0ca27a0f25285e24a31c395a78f6

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Code Cache\js\index

Filesize
132B

MD5
6e2dc52d6bfc8a28e267efbc79143d23

SHA1
dbbaf17eac35f141c234ac9c8a166846d0339fb1

SHA256
b30df4237a8ae88570d0e1f62af4621ff6e554d01df11458c3ddbeaf51d1dd7b

SHA512
8253b479249d2341e9654adb0cae2d7852451ca0acfebe99b355245c0e86ef3ea967b560229d9f38cb9306cf498f283505c30a04dc0154d890760b50d2e2ccf8

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
252B

MD5
758ea51ad2be523dc766a90ce5440467

SHA1
33c0f81b440bc14adbb6784a706763de9c72dd1f

SHA256
744506aca9c109dc0b06f083a57a163b9f7d04a7addd69d02ce74c268925bcfd

SHA512
d9c470174516126dd00e4aadac53d6f8f99aff62205ecff60e8fc5da78efaa7d48c7c34eb7569ff45ea77f7409514fcfea2237352219781f66fe17f284c17a10

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Code Cache\wasm\index

Filesize
132B

MD5
3add4c9e4f2d5dbc2aa085bde56a0d31

SHA1
067eab20290eecd76ceb34c834a49cb108afe3ff

SHA256
f55da746db4f27c4a186a418f0c5a6bbe9b74525c22d789c8585cb39fe0bd4b8

SHA512
54a055e64c0e29dfae64a4b53d59ea0b423d49b58eca49ce63d5cca74be70526077c8f23c45d864d4e35e925135b25af24879d7579599d1dafc901060eb74153

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
156B

MD5
9152fc0ec530072db38d39b93eec4737

SHA1
056dbf2b562780a4bd014b31513de2fa61b4c6f0

SHA256
e7671d940871e5c36a74e9eae7fc469268f4cc54d588b45999c995703ede1ebc

SHA512
fe2e560604af1a814e449f9f591c1eccddb2229165a333867919cba36522eb0ada5d9ceaf6fae690cf03c8057b5e0532b6cbf6b1150401429125f836086f5266

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
124B

MD5
d0b1c310b08edb6335cace1f1231f88f

SHA1
8cee4097bc4083f1719cd3dff3a010a2f7e70b06

SHA256
e29c3b6db4c311e48e0d42e6a7e9b76c47f480733663604e2f2912f7a403a3b4

SHA512
a0c849dce6366cf8222fc72102aa64a13f0b675b9b0e493706cf094a6c9cd148af0388124db9b6fcc88e757e743a6cbe1fc562d5097ac04a96393ac03126f227

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT

Filesize
124B

MD5
b718446d569f49bd64167488913878fa

SHA1
918bac56a74d9fd444b1157c465c5ecb24179c51

SHA256
4c4e8ea7cfcf12ad99c308304dfe3d9a571bdf2e35c3a18fbf4c363f8b9ea944

SHA512
5a9ef85db55cd8d66263348f73172906d9769b33380fe363516b1903766f144d4a5e2527ee72b579c2d3ae9d3a7bd6b31b0f5b728c8ca5cffe30799074647cda

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT

Filesize
124B

MD5
0b2270f24a0dfdb50f000576134fb3ec

SHA1
0c725323eb4c5c6451b318144293b7ff258e31c2

SHA256
45b614b8924c10150460fc331629864e605c1ef8f81f3596dd991d7e944c3040

SHA512
fcfdb5cf6163377cd24a61de7455ccc72824b79d7ba0e1c87f77ff4d85c9ff5028223b0e52c06ed29e517989068fcc76ebf25b67e6bf655214134965cc628cf4

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac3e09537bd117c74b243b6472545154

SHA1
38c34de816e3546645b742d72a5602c5d5beec4d

SHA256
d477c0148e008b45f71d975aeeebb2cb906b8ef503542ca55b4c35ca015530ef

SHA512
90a10a41a5f26213e66ed6f957563b1602d071b7dc2df5e03540ef7faac1ee072fea8d170c3cdb807cc51e1e1eefb8415c3e489352e5a083edc39f1fb6955a67

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
8e98b4700019b8ea629dc2f6314377f5

SHA1
90414db8b546bd420302da1adcfb3388fc89e579

SHA256
4121ad8791dcfe44af193a1cc9acc7b5ac18651ae10a59490305e8a49a134c9b

SHA512
fb91d3854ac7c1ddb27cef486e943e7cec82b1a1448d74bd0dc58570c13f1b7ccd70293dd880ec7472550e44d99709d94229140290d9f605856cfa14595175b8

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
124B

MD5
ebb02fcb99800291fc4215edcef84675

SHA1
646d10ae66cfea9d300688e62a0f86d0e9a5a688

SHA256
7da3fb6f2b5e24f6fee45b63b60038d767875b1850c74460b9a5550429ca6310

SHA512
1d0425fd1e466eaf71d8c85d774b8b321dbe5693b298fa6e522f9f0831e43ec88634008a66f3f82a525dd710f8261f915f5100de73fc9aa0075006efa04ca388

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT

Filesize
124B

MD5
e80b9e253a573e7bb8bec0fccc6c463f

SHA1
772ac359e437407ecc5e411555e2389a534575e7

SHA256
6cb427b6480e233c35c6ff5f23d2b2be2d52981f2b7c3da856b7fb112d16ad6e

SHA512
a8efe459fad15dd63d61b97830a567ea4b7e746a2d1e1f305e1e799adbc41e4d339b2fb5608cf35105009bb61b6f032e8697e2d850e602ea9aa22c190af4e8b4

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Filesize
132B

MD5
18e27d6c35c441394b614973de8fa27a

SHA1
a4a307beee11fc339f3722412dd760445e2febc1

SHA256
1394fb250759c7d5ba39e3e254f13de30aa473bf1a1ba37ab07fbb0e5938e482

SHA512
590b9d4a571a123966c52ea616cafc70aff1caa9adc1a75ed2b2db459ee12f81b06d260babc581c9d08e4b3f10c028e48160d3dbe8a3fdd2a2dbee9665a8852b

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index

Filesize
156B

MD5
e95607498ef36d667a890679065c44d5

SHA1
7f6a0e8e64edf49102e8cbb1152b54412d316ac2

SHA256
c8e0d6212dcd89ae8b4ef47ffd0a43a3d036c5a3b3a859ff061524abf85a96a3

SHA512
48a599bec041aee88f600a016841eb3982c3abb8254cb47c85a6036b47392cab7a4d3279e45afddf708fb6e51a2b9956de6897358c4f1442b8031017da7b0f1e

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Filesize
132B

MD5
3aabbb03ae993b0febbc9ce90b700c99

SHA1
88ae3c8a336e50f8eee9efa83df7ebfc4de108e0

SHA256
788eb060d3fc3aff1086479709bc5f676dd58d085015066502ee22cf07fe33b2

SHA512
e64c05ad5bbef2d5612c5bf66eca99bd594239dba13bdffa04b437729ffc38fe9ced43fa5e404aab7479f1afd245c698e01ab35b29954f9c13087cc98559ff07

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index

Filesize
156B

MD5
87fe42e537a88e2d05cfce8db9c6b678

SHA1
72dd48f22d0f52af6b18e24725512e0a064a8035

SHA256
846d338b6f9e4de3aca2f13645d5eb129b3ee92b074eac22e72a813f1a03235f

SHA512
a3b9eeb48b2c0e02b297a79f7a7aebe4064f70a40468a94615b0cd4a076bb100a3dd6e7975053d7d09e0528652bb038b89dfaeb9723585cdd5ffcc502a482333

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
0015976398b572a2372a4e301db0a8f3

SHA1
26e5a04ae9d6e1b3d32eeecc2922b0e1807f3e48

SHA256
85847ad8360be95ea3c492ec7a3eb05fbb6c1c0ba77130968bf68e06df1c7a27

SHA512
56708b6c06f3934b06a7653cf40e120daf843ed426aa704bc8cb6dd8c247e05434d89dd9f0255b5054546052204a8e22816cb960434008076fa37cb221c9bcc8

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
297b8737b233d5c0c8cf3e953044ddd6

SHA1
72a2fad91e2c266e3cfce65596fd79c9bfe607dd

SHA256
c4b436790c112de8ef2419435d9de075d1b6f3b28c28c62d09f38128f86288da

SHA512
e5e9b4215340761d5592172e323593ac593162e8b704360e2f102decfc4c11b54284409ce8f2a65278c6a11b8e312d8667769b1b05197271a607d6b78225bcc5

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
6467cdc46a66c29296bc5525a5235222

SHA1
f0e3ce568c82afb19d06e3207a577438227fc1d3

SHA256
6ac7f9004591d26640d8097b8bb502b27b01e25f4c887b5bfd9c5046f909637d

SHA512
5e3885a9c2ea38820362635d91ab5b57f186ab93583c8352cad068e6c414c454246b82695d7df40ba1baa17520e355267c0f8d6354c6dd267fb65a997a2d5201

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
f7ae9384d3309babede11eab194b0aee

SHA1
6391d6a164d01e03805c5afd04e72cd0d4e9c590

SHA256
9801f38c08fa844e68626cd4049e4de8511b5ffdc3b0a951a0738bf548f98a25

SHA512
599c4497d1cf5da21e4fc7c875a109ae4062cfac6ef6468a312075e86c75e94b664c1d60f1d49fe7a39ade4b3a8a0934d70a53922e9b2cc1eaa2a67e77db8aee

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Filesize
256KB

MD5
190ede09293cc3b8740e35d73b9f5752

SHA1
f7a46c95c2cb789731c5c37f23a0c619def268b0

SHA256
4979592d8f78f121367c2f910a192b44af648cb58a56c98b6a87af9cbaee172b

SHA512
bde38667cfb9b259b8b35e8eb3d0e4b8cd1c81c5085f3d220d9cfb002662349729ff61be41f57bb497ef59c88bcb65f95f5dbdf373bd9ba94d236e207871cedf

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT

Filesize
124B

MD5
59a765197a7eaa63f3a18f114174bc4b

SHA1
3d5ce1995d9cdf23005c6aeac9622924c2c53f2b

SHA256
c3649e88e66c06459817e0fe566d99b70597632914c3f9fe1744d10f51854cc0

SHA512
42cfb43e079365ae7fc049d55b9a906dd4d72c477788b7e2498b4cfcae8dab4bd008593c729ab0917cdb9dd695f9119d437e3b4da9c1a86701832c666f6cc42b

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT

Filesize
124B

MD5
5c3549f97401e528c84ae6bdc2cbae6e

SHA1
2eb9c7294c6d7cfb28d5e6a01a72aae6ddedef87

SHA256
98a1f0249fc97f8c836c8bfcb4ed3f9e2ac53eae899152f07e945381e711b3b1

SHA512
89d95b290d756a390f9b0d51368c34bb77eb09d1c5d5c0a1a4fd69f63bf4d28a093b5c75cbe41d078c410173bc3b70bae1a18043f0f1325baac5f5ddb5c0f751

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
124B

MD5
d78f02090ab04928eabe7840d6a96a96

SHA1
9f19591c1b07ac900344493379cf852aeb4e97cd

SHA256
4f1447f946c43005fde44ef6f4e6b8203bfae4b9df0d8c0d939228cf3d7020c3

SHA512
48b374c183cc451da701b2cc299fbaaa32a049e75d774348d3840635368acff3d72c258c344e63a5a03ddd32eb047d77931451a688964b3abf67ae23367cba2c

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
124B

MD5
eaa9e263670f0a642d3fc43998cac5e9

SHA1
43965a1f3198a91116b9b9b8557f01bbd97683ef

SHA256
b3b386a5b2b12f690ad463b094993c91ad6adac84310e101b098edd245d02ad1

SHA512
f9c10e16bb8a38b23f73167e76d22a195156670302ccd139364c45f2c73946b5da7eafac68c974730f59e760d836891c82214f7a07df61d8dcabdf0c4fd19ba8

Download Submit
C:\Users\Admin\Local Settings\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Filesize
1KB

MD5
9ffd2ae8b9527f8b77cc586f5237424d

SHA1
15a38bbb444e468ba3a180d93d85d31eef066586

SHA256
4148b06683e77abbc1b63f97a303ce74d36cc0e3c2ec82ad12073b307d2d2d3d

SHA512
6a8dc65764183d394c935f8ee1e8e46aa89ad56ace68d26f4ab37f92b7499d31f261768790fc5045f6824959215e52ec3148e355cc75ac643f01869a0b2e505f

Download Submit