hxxps://mega[.]nz/file/PVJXXByL#alfQ0495T-3_H-AUud6WQep1JJuZLaG1P4arwnxGX5E

Analysis

max time kernel
231s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/PVJXXByL#alfQ0495T-3_H-AUud6WQep1JJuZLaG1P4arwnxGX5E

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
5616	ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
2680	ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
5224	ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
3096	ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
1284	ThunderAimv2.08.1 - version-86c3597a87f4495e.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{A203F5C9-CF38-4233-9320-99422CF2B4E2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 298194.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4504	msedge.exe
4504	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
5420	msedge.exe
5420	msedge.exe
5584	msedge.exe
5584	msedge.exe
5456	msedge.exe
5456	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5440	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3984	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
5456	OpenWith.exe
4808	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe
5440	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5060	4504	msedge.exe	83
PID 4504 wrote to memory of 5060	4504	msedge.exe	83
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4720	4504	msedge.exe	84
PID 4504 wrote to memory of 4080	4504	msedge.exe	85
PID 4504 wrote to memory of 4080	4504	msedge.exe	85
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86
PID 4504 wrote to memory of 4924	4504	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/PVJXXByL#alfQ0495T-3_H-AUud6WQep1JJuZLaG1P4arwnxGX5E
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffead0b46f8,0x7ffead0b4708,0x7ffead0b4718
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:5440
- C:\Users\Admin\Downloads\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
  "C:\Users\Admin\Downloads\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe"
  2⤵
  - Executes dropped EXE
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8240 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8528 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8196 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8824 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4152818617763550014,16752823692698442961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x2cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3648

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_d3dcompiler_43 (1).zip\README.txt
1⤵
PID:2720

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5440

C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
"C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe"
1⤵
- Executes dropped EXE
PID:2680

C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
"C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe"
1⤵
- Executes dropped EXE
PID:5224

C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
"C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe"
1⤵
- Executes dropped EXE
PID:3096

C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe
"C:\Users\Admin\Desktop\Thunder aim\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe"
1⤵
- Executes dropped EXE
PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
20KB

MD5
781055cf537f0a2a6fef774cf3505eb8

SHA1
db18ed49e6ae281e9cb5c536a1c5139e43391647

SHA256
560348be56fd355f1a2b22203d2786ecc3d7afdab1688c4962ea830460ba4b63

SHA512
6476e1d7e02ac16524a08b74c16a78970b0caa344149aee94c80c93aeeb51e6dccc25e8acb1557eca8d1f4f3f656a73dafb38b13d96cf9848618d2474850fd3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
122KB

MD5
ee210efeb08f97a48db6867563180166

SHA1
e287c213e823078e8d4b9cf78f1223cc4c444e7f

SHA256
773cce2e482734572714961f59f9d8a9f99d9d5e89ff39d42ba0b4086c8516fa

SHA512
119a1ee02fbfa53776a4fc8b58b14cffb9af06038c36ba52a16c4a61c24107a027c3e051e599c0417858f48c3fbdb262839307c2d93834e6de51324b74e2881d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
251KB

MD5
94269760355dc29d625fcc20e80a5cef

SHA1
0027c6056c92889304184abc03b91a4ee35dccf0

SHA256
4784db290170a30a9630c8c1c7c632c0bf4b534b3fa575036d4575a26c8c5322

SHA512
4d286d020095cbae7cf4d92f17ee739f98a5970c263c4b57f90e16dd125b1853d9b3d850e2ee1f6ae057147d8dad7eeba6d09cf812f99fa1c350586fdaf68d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000071

Filesize
20KB

MD5
98a3c9faab6089f69ebab6fa26f8ec97

SHA1
c72dc16f5c523f1ecbe25626b758804c307492e3

SHA256
5c771a839e91fb87373f83b70ac4f68d12da2b58c6193b3012dcdc3c2521fa35

SHA512
c7372ee85e2e1743f2f31eea0c283b9a5617212eda35101d0ca94016a57dcc97a028fc603bd355f4607f46359a5b18e43d326b90a3853aac3347e143bbcfb67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000076

Filesize
1024KB

MD5
99061db4beb29630a3e16b22e0388d53

SHA1
2fd6132716a4bd805a1d001c0e5c4ad165b152a1

SHA256
218ff417f830c79ec7a8a4dc9bae7cc728f6e6b7602b06f289a2d5bb24d8466b

SHA512
fe5a69e1d95d76f0ab99496bb86152ffd48e271c72ea6fe2c7858d85a5f5df9968dc8c1374386146895fba8e88928c96f555eca9edac7a16881a9b5b7318a369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0c480c18bb43f33d_0

Filesize
38KB

MD5
342109d2c6d651c487ef5cae54b14624

SHA1
0496261225e5b60b7190bc3c34497e327c6223ee

SHA256
1746542fdd4b36e1dee2c9bf35154fc324ee23a1f1c87bdc3b3289018556b5a0

SHA512
9f4fe02968312b1252e33d178c42ec782469a4bf1be2800b1d2731f997ab0d09d46a7c3596db5b2dca259747fb1d74f95451685846e948df2abc196a6ae67f82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0c480c18bb43f33d_0

Filesize
229B

MD5
db8817a23245e6bd46dd53e8161fb855

SHA1
15fdd759367935d06a9f2b84de8662fdf788e3c7

SHA256
88829326653925d79f7462e1a78ed2f0467aa2fdfb34d2ced2629a099cc6095f

SHA512
fa1a90647f2a64a5d2de720fa7a07a77dc65add4f7a65bafcfedcdd5fb842b594b0ef311eba1fa40983c3d0c9959d5985030710d750ae51a79eae79a4713e9b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2bfabeba13243aae_0

Filesize
268B

MD5
03c02a4a0b2a7bc10423a81969afae2c

SHA1
308286273b2def101fac6b71d24ad8762860b24d

SHA256
633ad4bde802c53b4f96e9bf00a9a375d13683beceea1d4d39f58caff9b5bc8c

SHA512
a6aaa01c896963314b59c3b7a43c38541297d59f249bb62ec178584d25824994bdd2444f8e4a36d987225c8387d2390121c92e2bc50172e8480a94a2db740cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3c998ef47bfd7f54_0

Filesize
145KB

MD5
acc3420fcbff1fa4b62ec0b7a52fc746

SHA1
ac0a23e094bf2dbbc3c176b79bdec664fa1a3033

SHA256
40fa0142bd1d5d8c99e41a47433ed8640207a72bdc1de8e849e3dd7e76c22aab

SHA512
0d806cb51e3504d6edf4dd0ec3c984abec7b04de17ccb11a173bb5571f307deb2a9200ca2981494986c04cca739ad6fbddf48732f689de990dd72a02c5035029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7652775a8a50a6ef_0

Filesize
278B

MD5
4c5adaab128ea50e7237b7240c9f35ba

SHA1
3abf7c645d489dab7a779282eb33ac1927f769d7

SHA256
54b37067b8a7260b634213c4df4a583dd2dfefb2c9631200af08e7f90fe8311a

SHA512
37408293a22afe5a5f94522d5c8fa9fe9c846fb69c53021d3b948e2b25d826eb6f4ed6604a79f54333399bdbdca96a485f73f631cb70000bd085103794a61c66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\765ddadb97c1b2fe_0

Filesize
14KB

MD5
7427d615f0728d413c7f2276dcc55347

SHA1
c10b822c94dc532c475b12ab7f8730c4c5f2daad

SHA256
efc264ba14fe21098121c880385e9ffca2ce6388e267ad93bcea030413791562

SHA512
08996c03fa3bd3873f13a53eda1ccb097791d0d686a0429c60cb93bd89366ed4b1e4b61ad2ffdc82257afbde4aaad8a109f57983ae662b62d08bd0c9fa931209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e3f74416e74289d_0

Filesize
54KB

MD5
a820e174fd6885f85efc2fb7b3397ca6

SHA1
7e4ef2e121f1d8d817a52d7cc74d79ef70c1cf20

SHA256
417c819d2b1a5606ebe1848df0c40c2fb30c5593d6e34b6bbb9246ab6d45b7f4

SHA512
fc4178873f929d7d06e420e674146ead304f76049b0a056b11f0bcb771bda499016b4dbfa009a6de31557d472365b6eda1dcbccf599f20fb4d0604497e9d6b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b0b2da0ba0bc85f8_0

Filesize
333KB

MD5
926deb07bc9bd874c92a71ec48f55d73

SHA1
6f6f5417f65abc9be687a2b799aa2ad4cc41bed7

SHA256
80266f93a406ee703643e5b31155edd7c6ba655165f116532f0ba8f2a6b25db9

SHA512
575d42cb259c599c2d2e0c1832e03f12eebd2d20f7a9ec626b0feb2982e01a738dac31a7faf17b215b3bc8d9f796891e38eef372eb9bed5914960153af864dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b31250eefa3dc5d3_0

Filesize
23KB

MD5
c1a51eea112528712a8e02bdc1401585

SHA1
3935d96b41af8dbec3d83f3bc56feb309f2bd597

SHA256
da704eb03005007d0c414f86c7b67cb05e4ca19570feaa3a2b6630e92c540cb4

SHA512
cee0fc54ea93aab48f518ca98789807615eb21ed9684af184890154ea180caf4a43911d4aa8b8c07ca9f69d3d046d62cd722222e2600ea6a41e519ae56ff7192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
15ca91e20cdbe95044d7a2333dd50750

SHA1
f4cb2e4eafb6b2e1a5b253b6f9478a50f921e685

SHA256
1b1a0da8aee9332a17049f01a6a511f34d56b659acbb4ca95c1fdb9f37786434

SHA512
3f60a2197096644271dbb7a89ecf1a19aea3c3f496d28f1ff67bbc19fb6c07d105dbbc5d8833cf07aa045212981166a1505a9795ef00b336e2aecc2caf7cf4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
64fd93bc9a205680e180d7821a5f467e

SHA1
c65f713012fb7f7cde6a33bfd7742da0fa5fbe1f

SHA256
14220c0637e5236eb978bab9aeca09f8a36ce6022b8ee4d527f0246f9cd54e4e

SHA512
0cbf3b4f851e6e7221ba73153799019b8236236bd9c5c12786d4c289cf505ae08d069c627fd16cbdf99937f0b6ec4357929128019c022cb048fd3e3fed449c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
d7c6ea67398932eb03fa799d5666894f

SHA1
87eb43ab6928ba10756c570ee79b714d3f613b67

SHA256
ced9eababd3640d259accc7e0f87d7623dea37eea63450b2fca2670085f2dc03

SHA512
c04456efb5816c6c92139d89b393ab9b0b3af74af7cee8d4d28cf98704416439b3a9afd6449dc19d7546446b08a5f52b7287690214d6012c4f59612f2081a32c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
16KB

MD5
f7739f8323b6e6a626bc6c0ebee435ac

SHA1
c14703a062ae138ee53b6d8414b14963582f8ba1

SHA256
a4877bc1749def22d0625e4f7e9ec5521dde9a1ed9f138cfb27a3140275338e5

SHA512
ce25b3bc1ef64256ad68f5cdfd2b4963ef55ba807658ebeee88169231a58f510c938258b1faef2da18299cd39ff58a8c39293edcd7575d54408c98743ddaa8cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
9af09ed98cf553ec08ca9659d289a3b8

SHA1
5253f54809648acb1316c61d78def3004926debc

SHA256
bdb81faf11674e465d0929764466244468f723fc9cbd2eb78bc369d58f1f5601

SHA512
102942809fb0c22b8c61f854c5ffed91612687ee68a1dc4be2f8832e50fbc14a36a03d6d027989e2f41eaddb226c78813895409f8fa7e5f21049ab655ddd3f5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6981955ca7221589daca30f784cfa3a2

SHA1
1635ce01811167e183c5c7cd042be3d826949fac

SHA256
97143bdf9182354a4bf902686292135844aa031c18832bcfbd89c81517e48ef0

SHA512
b4437b62086d847819b0824133519a169b9bd76dea54f8f2f10975171eb838fc63fef37956c0fe02e97981e8458ebced79f95a2e29a4860d383199e4cf0b4de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35c58350b4d09815eb836db3ed68266e

SHA1
1bac39cb3ded352fa27118d8efa255f23ce555d4

SHA256
21ce0dfd359b30162a0e737fe52f21911a5671acfd66428be94ba1bda3b17663

SHA512
d50db8aa98be3eac2d530f224af3dd7b8ec7fb0460fb67d9a341973d28a695327675a95ea0eb3ad9ec05b6e39f3e717e0a9ba3abbb096b62b8b8e70d3f6ae481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99ab9a04046468afe8fce3a1666daeed

SHA1
d9442d50aac0e7b6eb4243ee43f105b1f87a1c3a

SHA256
26175bc3b7a91d19b43cd9730b094b33a263d6c3b1fd787231b4dc38386bb8df

SHA512
fc5853c45bf2d2efea5fb2a5bce15270cf6cf9ba5749fb504bfe8296c04bb6ec4bf5f79b85c7c146644bc5636bc145bfcd466593350fdae3fbc3be510af23602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
572efef3beb905518eaa7f38b2256d16

SHA1
4799e49449d28731f07e932b2600bfdfc4f8ff95

SHA256
f9c457dfb916a1d763a1ce01ea101c74b0923402daae1bb73658edabb5f973e0

SHA512
ab66d1c825d50dd5c4f18168eebdbde9659af23828936970485560d6c6bb5b0d574bfcce6a2d39555e29dae00182a66ba2c8b108bf175fa2a93ecfb1c1f0996f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
a49a99a95d3b614c3f8e1bd8b18bc7ab

SHA1
70762f38288ed71cc660d3530fb2cceb38f36d6e

SHA256
1fde9812cca11a0d743cc590b62e9ce86021ac53570071bf96341fcda57c43e4

SHA512
db4512dcbd7c587d1ee9acbd0603a510fc4c2495e7d3f0f8bdf55f6962c275da36492943c89bb8355595fbc30e8577690af525ac24c4d12e30f96bbe7f38c40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
8bb69a2239aace69bf7634a8f04ce10e

SHA1
02e0920750b974bb5bca9456a34c342f31d50b05

SHA256
81f004fee3a4b70667c4a4b261e9c83aa90474513c956be7685dbbe5519beb43

SHA512
0a46eb7cbb059a40953b9850822d89bf32c9c7d295cde335555b20cd5b11fe39dfb9c5b838b9a0c0ff3637e3a45b0e24dc28f84ada57be5d9562c83c7b89c01c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
3f8610baa953f51c2ea1c46a5f05a864

SHA1
e8f8292873f04754ff068d081b6b8935e65db545

SHA256
752eaec0100d6568ee7ce56028d8ec5526b35458920402f7f6dd57c21ee95e61

SHA512
ea200b95f13db8c641f2aee1bec4f502888f000d1e63158421d275767cbe204131faa81e28bc00823bfd0a848a1c0fa786fa4469bedd1092748d9e7fc530d05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66833c4d8070ea2d4ac886715e60a3b4

SHA1
3131055e1e65f500e6358091aaef87fc2aedcf08

SHA256
3d789f4d6338e6521e49df93169bfc00e5331bd09e10b3975e9c9e350bfdb0a9

SHA512
a0fcd608a5ebc78f5312c4a0aa19df00eb84e4c842c91b3e9adbd9213b9b76fc7fc7d783f78904eac69b903dfcaa99311b950733792aae1478b361668da3c3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
796febbc4f379715e50af77b42a02c8c

SHA1
400d0e6ba1792663706be21de3c96234387a1c40

SHA256
b6eefb6b952451174c3c58710ee1c51101c24bb66ef8436084e858b2c41027be

SHA512
70d0bf0cc61a5dff1dc9af91dd8167197fe9f7d01a6d26619f49b6b886a2bc33b972525b46c78145b60c00008efdbd0fb6fe8a48500613371e558af9e2bb7f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b409e38ba80bc4d87499b0ace0421b98

SHA1
d7db9b67cf700651cd7d8194b43a6a8568ed1da8

SHA256
fb8dd7cc4604bd9350a15074606dd15b5b5086be3d9930df3d79784a78518c9b

SHA512
a9962393723336ec4d8ac0a112cdeac312280c4ab89a35130fa431504ea754b3bc41a23feaea3c5174276054abebcbb28dda1a92bc3baeeaa49e015374a69554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b875ddd2230789240079f8fc625ec957

SHA1
8a20f0356e8f68f8f33680b0965622900713aa42

SHA256
22fdad4c065ad725bc336548443c568f5b2d30957c36708dc6c4abf16c12dac4

SHA512
6bfafe8a518ba1e84f6aba10a6180b60fd4d3a726020416c4cf67b8f5167b4268674986f619137272a25221d12e5aa12569de038688a736636d5e1819a2eeb62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5118b9b71a6ec3d7fb80a93d0e289b4c

SHA1
e5ed70aed1f98945cc52eadf288e0509e6721a2d

SHA256
9af3e5b735fc16582f5931423617c4e36ab34a9f05d5b15a53a8d8bad568e174

SHA512
8e5e2125782ee37bd8967a753fb1d6ba4f28a05790b5ebd43b9badb180666c65bae5025941d5575c07efa3dc8d1ee49f0696ae7f4d93ade6f38f325243c6c649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58053b.TMP

Filesize
48B

MD5
802e02ad0b1222311d4496a47ec0f680

SHA1
55787c2a100c35361fc5158a65bac34dbbe6d09f

SHA256
dd9d4771ddf85c698f8b555436040413cc6d58965a9addb324f532e732e54544

SHA512
63affedd225979b81baa326d7cad0b21a0fa46c77394de93d2ede6e8a0939d933149ac71118c5a90b49dc94f9c96ec2ccc1c1e9b1eec11d32beaf7cddc49ed69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a421182086e7e3dd552d564e83cc0aea

SHA1
3d90badfe17dc04f38f7007b435ef7679496e0e0

SHA256
635d559658fc6975bc2f1fc5455057df9a79399cfcb8efe997df7ae88a3a9b78

SHA512
73dbb920f3043615c8d8522ce226d18ed0aa380cc3f442a490db93e9d7f5c69030a0c661abd09573920361b5fb1819e9d185f344e50ab3604d5abfb2c82c06ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
79e2d33e2c631237d85d9f3e8eb2e542

SHA1
ec6ea6c6de043791718f300d955f35ddeae28adb

SHA256
071bef3f2372eb94594427cbdbb222244642cb4f6d030caba4d7b8a81df6555e

SHA512
225e131cf76dbf68ea6da91ffa7f2afd3758b409e2f265136b842d51648f05bbd9feb16c6a661caa4c813172576d7d39a32dcb4fe6491dca36b9526ab6e13fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0966b49ca5843e5fc29f04fd0e8bfda8

SHA1
e27efa97057f0062b159ff8598d4cc163d779322

SHA256
5280b5b582b056410607e2f24c8311d8a1d288073a76a255919f758bae595523

SHA512
0726b9e664af641deeb85ba22c35cd1444a2e9029d02c3d5ac0de699a5ab93acacbc9557e93839718120805062f62437b2f0582e4b562fa9cc969090e396d90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
01f26f1e93a7acb9c648f418b154f393

SHA1
717d46d30a990a951e948d50722ade96021510fb

SHA256
0248b554716192e34a399407d538bd86cde68dea49c54a103a0dc7fbd5815c8b

SHA512
61c2c55694a0509ba28cad91f2391d17b60e7c7cbc6646f395045689d35805e2749cf5cd501d3d7d8feb5026c8ca217ad23df1a58e25c35492e3a9d3f359e394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
52e8f89c95ff0848b8182dd5afa79fb4

SHA1
8a9ef221403e0ac83d6d6ab0e0bfb1ec95aa8462

SHA256
11fee4edc5b5216971df79f36bdc7bf2e041938ba086378d8cf86ad6cd064496

SHA512
9bab94e335dadccd1bef2cce8d47d91f478b1b8fd77c182a082e28a9d5ff6cbcac67fbf873e1bfefc0ec206ab29337e67f151c4bca46a4d89b1f58f8c8a5443f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d4438ef13a0a3bb0a0d3c28e328ed86e

SHA1
1afa3d2a6ad0a3344f0873916f2caa3847146a00

SHA256
26550be7a581d0c8d60f2ca0272dcb4b3419294619e435598dc89f7059b70dfa

SHA512
7cc7653462da11fa470ec2babf0981d1c5f9e8c2dcac03d2575eeee5e1bfb5c6ade347928d19b85b7e650a377cd130da4a9941f19b882eaf33e7d915d324f1c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587da7.TMP

Filesize
203B

MD5
60a214ecbdb535e8b9fcb92ea4c6a496

SHA1
985fd986b0344f0afcbd740d7b3e6b42e0e24405

SHA256
0ac8a89fc79965d6bbcf5b74136c12998dfc8eab94678a303ed82a6a9315a0f1

SHA512
168d1841eb9b96a380b799ae9930a9bd5cd37d999ef713610749ffbeaddb85096c951e17c1315dc7412fd0d20b2db5ddec81688ebbfadfaeda7309da00c69b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abb44886-f97f-4cbd-a1a9-0ce043f0e20f.tmp

Filesize
18KB

MD5
709613b2191c8b35fd4f252e5c075e5c

SHA1
9edd8ee729bc91671fc49ff3868587641205dcf8

SHA256
7469281bab1e837a2259998b652c4fe30edbf8af371eb1922c90f09e06cd3965

SHA512
d5f789edb9edc417f676bc61bff93c9bbc15d47523c0288e86208434f8741bb3eb860c69d8bd83df590c1a825149c009be4ddace70594c69eb5937ea349e1faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
53f793933aefec83594e9a36dce02dc4

SHA1
82bc2f2dccbc47b4a17be166a9d59462be4a3825

SHA256
58a30dc007795d27d9d250a1ec706dec65937698e4cc77477ce3974877b677ab

SHA512
6dea0081b025ab15997d4332860a7320cc0e9019b64893d433652d8a1081321d06581dfd6ba07f1410dcc7ab9686af8168a4418c30a274469d2bc7e42297a00d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
48c780b510bb10620655c3da5e23dfbb

SHA1
ea930f30af1425a65c7f6c6531d545964f6837fb

SHA256
fbbc23eaad1fe136addd63c6d33f0da719b0626b06dd9d11b08bb3f8e05ba419

SHA512
2009278a9f87e00494e4b20c6545544fb38ef05f33c87c6b6062d0b2b796551f0f4ccf7f52bb729f4c72161480a2a0bb04083c42f1650a8fa845c78c7205bd73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
08e1523f6f530a23afe7e135d0a3f280

SHA1
fff5b0a8378784fd623a054fe3fefece697a2315

SHA256
5789ddfe0464119ee4a04ed1dc1096edc9b571b47d26f9d1f7ccfec6a8bf8c76

SHA512
b79c9194c195b9b7c1756e64b05e09611e672fcd8f84750a4c1e1a77a72fc5efe2fb005a5b4876efa849db76ac2aba1bb4f10766ebbfc96c117272475e9a8c8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ea95887df20484418db5450fbe7e4fb6

SHA1
6f91b97e4213dfe458bcf986251e2d85fa3d1027

SHA256
dfa71b88e1c3267239e41119b39147ac481486cbc17a823c6d69d0115bf9a4c5

SHA512
19d28e3080942114a7b1a56e1decc5985f711300706e7bff32f488d14fae1dfaf46aad2f808a55e66df67a0546e2283d923232228748c463b09b258f286def1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
21025224d855fda23e5adb1f07c46aaa

SHA1
cb8ef8655f5e73dcc3815c4bed054c89ce078291

SHA256
51bbb5e3d1ba6f6fa7e5b222e166f3e0236e1ef9d0366e5b0f05f00b2283d102

SHA512
56a76f42ddebc207ddcbc0e4e431078407cb8f67cfb2db04db969beb4a328e90a23da0f8a99d4972de9c951c30042a11edb7d5166e0072e31314dc889bd43c41

Download Submit
C:\Users\Admin\Downloads\ThunderAimv2.08.1 - version-86c3597a87f4495e.exe

Filesize
1.3MB

MD5
d14f4bdc2bdf9f97cace7cdd3cc098ba

SHA1
f82c1327b99847967a735b537dc2b4904bd38961

SHA256
69898a9129825c959c04bcf2c29458bb298da9957befa201f8e491a1432adb9a

SHA512
95f03adc9bc8e2cd43d5ad2401bf82a73313e73be9ee4ea8690c5b73e7d1f25405c81507e6b823104f627046b6dd7e43f721e01737c569289e504aaff58ee77e

Download Submit
C:\Users\Admin\Downloads\d3dcompiler_43.zip

Filesize
1.1MB

MD5
f0cbcf3946b3dc185ae6f12ad6b6fb0d

SHA1
68da65ad1dea5609dcd564bcced045c6b5663b29

SHA256
d7d854173d6b629d378231237fa309782f890c2ff70d175a8d9c321f51ff7f20

SHA512
4c067e36ed049f4a4c0d055bb1c5f455fcbebc24e57d9d280255e44055099d42c6b441f87a9a5fefc1b3df4412d9f309ddd942feda0616ab97fa837e152f401e

Download Submit