hxxps://www[.]dropbox[.]com/l/scl/AADkgTQbmuhANgv13guovWoKofzzst9lSc0

Analysis

max time kernel
191s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/scl/AADkgTQbmuhANgv13guovWoKofzzst9lSc0

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
340	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{DB87E766-9334-4AE9-AAF4-825CAFC88AF0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
3012	msedge.exe
3012	msedge.exe
972	msedge.exe
1932	identity_helper.exe
1932	identity_helper.exe
6232	msedge.exe
6404	msedge.exe
6404	msedge.exe
6444	msedge.exe
6444	msedge.exe
6444	msedge.exe
6444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3208	3012	msedge.exe	88
PID 3012 wrote to memory of 3208	3012	msedge.exe	88
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 4364	3012	msedge.exe	89
PID 3012 wrote to memory of 1096	3012	msedge.exe	90
PID 3012 wrote to memory of 1096	3012	msedge.exe	90
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91
PID 3012 wrote to memory of 3668	3012	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/scl/AADkgTQbmuhANgv13guovWoKofzzst9lSc0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb271d46f8,0x7ffb271d4708,0x7ffb271d4718
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9292 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9328 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9748 /prefetch:1
  2⤵
  PID:6188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9708 /prefetch:1
  2⤵
  PID:6196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9228 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:6208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2000 /prefetch:8
  2⤵
  PID:6716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:6224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9396 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:6840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:6664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:6396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8992 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8988 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8312 /prefetch:1
  2⤵
  PID:6720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:6460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8904 /prefetch:1
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8912 /prefetch:1
  2⤵
  PID:7008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9064 /prefetch:1
  2⤵
  PID:7000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9604 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1114624671258751037,9450770770845430811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
27KB

MD5
b24491727af2d0e552263cb01aa2d864

SHA1
c72f6f2d46d9f2d49095deff70013b3d995279f6

SHA256
b8e9ecd89f87a664ca94b33f8efd599c0e0239915f021b956fd0a8d64394aebc

SHA512
811bdedcb46801d18488be10a5415c24e141bc765efc47c85f56da4fdfbe184aa5f0f3fd5fb65d5b84157de9dfb6b3cf5008dfe99676ffe247c4f82e10238ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
30KB

MD5
995c0ba77133eca6e5a69e91dd1107e1

SHA1
857dd56d1257c26e00ff64e0473b96a939533255

SHA256
803a27c40f8e6989a89358d036d908af175ba49977ada0e12d630bdafdae5558

SHA512
d6641fcf0b4a3c290a5825695271c68dfcf758849d31d13a3e1baa1854913bdb108331cc42098a137c1c02838b03932d9967428c8fbde110250e842bbd918575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
728KB

MD5
88df41b51ca67ec987f5ea1c8c84701d

SHA1
684d6ea83a92411d41f041a13c9991d7f927921f

SHA256
5498a8da0948d6ef890ece26caba22630d804747989769b8e3e20d451322b84b

SHA512
bd2a32ed4af2e14217ac3a484f91372fb8ed477338c095d1c7ab8401e15e747f3f62bb7071e5d3f6ff49557c6e24aa285b57a216c8b32f6842e19f245e3b6696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
36KB

MD5
a309cf87ed50c68718efb3b78ccd7cb8

SHA1
86defc54b345de4d75027e59c31420d19f805a93

SHA256
0690c2fab082ac4940c5934cfc6c7701da3409e13dc83d673a4ab5174b31f11e

SHA512
115cf23e8961a13daa16dd26c221d47c8a665e94ee5ecb30bb1f9a8df8b85c4e300e60b361054524e4703a11571d541cc95df06233db89a38c1fd380f60e04d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
17KB

MD5
34eab00bfeb7e9806513fb1d13bb27cc

SHA1
48569987b4e0f700abe61801f87de1e393d16afa

SHA256
1b95e78a5002371e71a1359b3faf8fcc728ae0de7ca10a8f31cf9b31248f6b9f

SHA512
593dc977cc308c33c87df9c563747ecc9e816f74bf084a8a1f21417aee70d6294688ebfab227a2a4a81c72fcae87ad4d316753cca047754d945e29fc0f371f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
42KB

MD5
93b6f18ec99bcb7c3fa7ea570a75e240

SHA1
60b9e3062fe532cbc18b897fac542c56a03544c7

SHA256
43693f7bdd6146e783fab3f75ba0a51aa3cf9530adbf790dbd686fc8a17aa3db

SHA512
ac1a9398b74eb75ac4d52b9a9054a1add5a836f2572b99307851a0bb6d93288a13199e06e5df4f1391209403bf775c9235a679bd081ca7f62b7752ed0fa691c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
53KB

MD5
237aad684514b77165115300a45fa3af

SHA1
2d42d9fb68a83c98693a0d966d229f5dbc3d3a72

SHA256
40d852f2a2082060963bf762ef7e69a938d0b8acf3885de575594c197e6f16d8

SHA512
731b5cd8237997f2b6e2fd99bc95456e6d0d6881a3ab90a243e76c2f825635798a9c6641207ddb59b217a16449f8868035b612dcea0ed331f9822c18ae68a185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
53KB

MD5
ebee194a9b773f166dc16096f8614aaa

SHA1
9d6a893af295c90e9e9792d7e54a80034192255b

SHA256
00f90db31f42975fcdc5fa1f70660568be68792ec11be2aac36362f435a6e555

SHA512
b1e67f381c8266ff60e09cccba6cb17fe0df4cc8d373e15f20f14b6e8c2f6bab4c0e91163e57c3c2f4593ac23512a43b2129caba1945870be4493d1def2ddcd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
30KB

MD5
6fb26b39d8dcf2f09ef8aebb8a5ffe23

SHA1
578cac24c947a6d24bc05a6aa305756dd70e9ac3

SHA256
774379647c0a6db04a0c2662be757a730c20f13b4c03fe0b12d43c0f09e7a059

SHA512
c40f4771c10add1b20efb81ee3b61fc5ede4701587f29a1c2cdde8b6faabd1c76d769bf8b99aa19082012f95d99ba448a472463fb9056acd2e43542e14e605cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
63KB

MD5
11642fb7247934422c69b24a90a63391

SHA1
4438b23266d6759fe3204f056f506d8908eb49c5

SHA256
9ae549c16ead066b18b0fdab6658d6a1cf9341ca738a2d92b46236c9d11f807b

SHA512
e3926bfd112f90c5e4244cafb50645ab1bf24b354db02bf33a9d5e0de2f03c506a883707d796ef1c3e7ac6973e6ae4d4f31cad434b4716af366b12536b5a81fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000070

Filesize
45KB

MD5
dfc5e24cbc1b134e0c00c61e84ec999a

SHA1
d3b1a8ef1d0f6f9162986479252570525719f203

SHA256
b5db3e633ec765fc01a19c06b0955d56c2503285e59d8d348d08ec34abbfeaf3

SHA512
48726cb83bdd0eb6822a73734ae272286483e8aeb6e18f57e635ed9269ca3c6c62e2d900224138dafe32a79a94c3c7694307ff413505d695a77fe602681df27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\336a68eaaf209f48_0

Filesize
261B

MD5
c9fa91d18b1d18168c4efb5481106f99

SHA1
d04d48a6f02c46f241d24b0936b1a4f126130213

SHA256
6fd1e6a00b28104081c35102e28c807c87ef9f8856242bb97771ae2625076caf

SHA512
5342c23cf31aaa29744443e30f0d9b48e3c1328267381b5b6b9375fa12d28d4772be4f9a8209cb7e40ce30898aff76b3d7e9a4411a620e1930db631bd1e3d3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b4565198b1a20d3_0

Filesize
246B

MD5
a5cdef718e1c5bf4bdf69f54a00a1a2c

SHA1
6c735fa42decd3d3bfc38b487a9fbb4e8cea0809

SHA256
49d8a1fc855af2c543f86b13acba0ef09dec748323ecfcbc1d6473f906a0fd00

SHA512
fe421599afcc44da23a1b8e84c15928e5ca13930f2e415abfe002fc80a9f8b586451d35b0b8155f9997e50d8d4e553f6edf281a775cfb8bd93b57c00e4a7ca6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f255828496f27cd9_0

Filesize
257B

MD5
72d119e4095395394c3f952d036c9a99

SHA1
2c4a501d28db81f9c9d2d4dd0d160830de6a0dad

SHA256
b28e11242d873de735f0c7d7e2fafb01ab2c066209bef521d2a7f2bcb8f7edf7

SHA512
3daa072167c16a1ad6e5993e62d4cbb58c95f47e4ba58153935f1dc87166ab542aedee6d3381277d12aa7ece079ae0391f178807b963ef5497db0f4803f4f2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
66c52b5f6c7c82a5bc47d4ab9c662fdd

SHA1
875696f4cf35dfe77d7d07fa71f31ea187dded0f

SHA256
a67382a11d0b9eaeef2a284ee6ebd5f6ade13ff9d5c9d8f968176074a7de8ab1

SHA512
39d2b0f8d6149dcde89462ea119dbee147fb332ba6cc8bfb3ddd674b8b5670b42bf7c3279d984b9aa3e2b3f306ee03dc6456dde1abf4419dc55675695fec43c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
94e00e401dbe0132c696dee089f70b11

SHA1
40ac30f4549f8a03c2393c662fcaa6cd1c6474cf

SHA256
a77d966ae72da13561128d6ca99dd43f60058f9e3c92628cccb0a33249fa2ac9

SHA512
f00b8e2eace7ede5e51c5604df7a91a99167204807340023b29770f0fa8087a7fc4b569ccee134465349dae5b72e1a4513e4d4c65cef2f855451bdd538728a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
12KB

MD5
b296cee776da7a11063b01f0a1bd099e

SHA1
a6b224f3b75e1e785c1949b3251a5df91304db9e

SHA256
723773059cbf8eb3c8b84525f6dce458473f095dfd9f4ae0c9e189f3b46ca9dd

SHA512
38f97d2afa90deb261b474b58ae62a4250391d52362fd3f253052a40b8968c9fd57020571bda17391fe966f7586caf15b448d11ec1f070f73c280420810e82c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3772486737eb307b1897aeac5aed2ae3

SHA1
52467026bfae776f43e4204c65eb37bf52e1f3c5

SHA256
18bf504a58660db8512696bc0cc8b1015919f23493b21ec0f44889a93dc821e7

SHA512
d3a5e77d3ada0e3b636fe18308495302c2870904dcdeb5eb17422fbc5b72f49327c47fa7a02a52b5045420697a7cd9144c5932d07ec43d98df8e549ff33ea556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
c0e328a9b75cd26a77a79687ff4dec2b

SHA1
b7e131a1041da8fd53ec7f660d420d479056264d

SHA256
5f4c12558d5f27728a0f3b75e748a2aeac83ee0b0c5cf046870a408e44abc1a5

SHA512
3e96cf831fe1dbb9d8e521c590fe50ed50202cc664cc104a376bbce22fbd60d184dbe3fb1187128c5849a6241b0cc3adf04e77f7e58d7647feb9cda0977a6e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
fd4e464ca6c94085475487a3008ab672

SHA1
ce1002781df2ffc3cf7730ca09fb34e917ca67ca

SHA256
8dedaf86465dab644f0b74c4a273990e486a4e0f4b82bcf4a8e3bc177efb9721

SHA512
3f7ed246b0046f7889720268f56163bd0cd1dc105fe9d7de143bd8128fc4dc62ccbe1d987d6d7df01de68eb2b3c24dbf1da99d79c6a74a39b83bb8e23334e3ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
fc5e477dc54745c67296214369f08565

SHA1
0b907811efdb1e6b913f296bcd365a0da2e4798d

SHA256
f8cd1576c1e6e01a9c6937a10eca1bf08ff02dff7486604a81ddee3b8b8548ea

SHA512
0863e633e54fcf4eed6c3776fbf4d9eaab7f4b1f60b3ada57e1c2310e3d2b69ee9759e53cc241e9ac6486de2b9c919eb5124b56c572337903b588b5468e01172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
9c81ce7ebbf33471ed4d79c1769f77e7

SHA1
21a8d13140823182b6518a510af6d2ec3bdda038

SHA256
5788ddb38366996495a2c1a6a6ca49af4527737440655e3907d23c01b6524908

SHA512
a700f10faa650fd8799532135af8d5fd8cd0651688d8839dc148093fc84fc3070b0f90d5f8582f8eaba5acd0156171b5612590cab2cd835156d844a81db08c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
dcfd9f83b216ca5b7bf60d0be7813bfe

SHA1
d20b008b5329d261cb4285a30f7b2b35a672beda

SHA256
d41846bb0816028f66fb26b498345dd2d7133d890504fedd9e00c29a36f53ad3

SHA512
bfadb37dfa511f2b94b854ed459cdd789489a68358034803216e187750cb13fa16703c13ced029dd648b6c1150fc24065c3d542a0e5f0b08fbd9193225ad7fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a2202b927ac116be4b334263153c1e7

SHA1
eae6d824e04bbd37566ce243c9b2aca0d1090ca4

SHA256
0a759bdd861ff90ee731c3ac613147bc91c71c7e6f65d6c637e1be87e44d88b8

SHA512
7d524d43c9e644ea5429ca154e5cb79028c507ff9040cb1841c28048740d87d029b42b1a2fa5ff077efb73bbd3d578d6cb08993b8d0b226902a53df1e676456f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9136c4c776689ec16899720020a8ccd2

SHA1
4b4cdf9a0c566c5a1d3c6b1e286e2887c52929e5

SHA256
233f104ad875fed48ca69a31d5fc67660298b6f55868f79dc752f420af9f8bdd

SHA512
721ed6fe1dc99b461a9223a7c3c2838213282aadc921e7ddd5090ee8665c048a11d5e215d186f1866947537769c9d8779b04dd9e25f21c6c06f9673982d8ddcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
91c9a5abdf76aeeda2568c0be911082b

SHA1
3ae81f8cabcb0726b0cf19782a8004599cc6bdf6

SHA256
35087b9353fbf7c08ef9828afa6ccd798824e276e0c01bf5dcc85d1a98583d0d

SHA512
80545d651e6c553c02a2c6f3dcbf885a7dd7cf2c39ca29b3bc8acbd85f48b0007263205ca07448d645423b412d135e3c32ddeaedcaf94dd42b682886d55b0dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
6aa1b1ea0e9f1049ffdb13081cd9495f

SHA1
f1027610b56bd5f814a608e4537145f4eeb2767e

SHA256
3984ffc682f27568a94a898ca46a6c5f33cab68df17fe596053ebbf45cc71f53

SHA512
39dd7e9d0c648431dcd580226dbd0876e2a6a710e7a0cd278c1afbd6e7247a9c7bbf685fda66c5a4178d6783fd82eab73eefaff629207fd950942aa0b8e5052f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4d162862eaa515ea02a398528670cfec

SHA1
bd858d8bee53512c9f300988e16a65dea400397b

SHA256
1795be2246a443e3638b7ed3a26f1605815744c8533217bff1d4f5fa35e61aa4

SHA512
5b726e305b1dc4177e7e04f154a3be23f4cd3fa570d52d530da8905eb506bb48409e930c4b76e77f566a8f60dfb5cdd8310133930620a6ecefb5c2d8bd183155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
571547aae6747930ee5e4ab543d956fb

SHA1
2cbc3e0f081b39183ced43d2f28381d76598a547

SHA256
3edacf72ccb6c1ebc41033c01e42858a9ceb0d8749de152d5967a967aab224cc

SHA512
33e28cd48cac2dd8ac0e3e76c98d0b5e026b34b9d3ecaf5f2e24b2ea9ba7d2ba394d14ccd05b798594f6cc7cbfd90794ddc58d7b31a8cfd63287ee02fe34f42b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
cf70d487dfdc718266ed8353c7855915

SHA1
462ec4ef82274309650b3e586564ee7f0afe880e

SHA256
b6a6be915eebf0b2e8a5e40411bd51ae2bbc1970e52a9b49eab9229268a4efc9

SHA512
ff551205eb6bb025948347e17a57d4b7d1f0a05d01fa2e91b22dc7b65634d6b1a5ec593a1c08294f5cc34996b52613537741fbc0965000ae543ad211c1a93a06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
56a808fa189726af4c76f26d008d4732

SHA1
54035730861e1c0dc095a92e57e74033c5d5397e

SHA256
fedef5c8a7db85b92a830f919f06b418f9a5ad7371c85b06d49fc5fac9441aa9

SHA512
a042b43460f3681e7854194e997086b3b5677294b09d5247b42f8f2f5602a520393eb8df5ce10f962fc28cbdeb4dcbe8d73c85dab496176140fc763c41c1b525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b2e1c7ba638eeb18e8c0fbe024a5d846

SHA1
9b06aae1b68905334306f36cdcf3dc851dbfdafe

SHA256
d7755a8aac4717f5291c6ecb22e1e00e4271a2044226483b1786c51f5c0de55c

SHA512
8df5b6cbe0091094dad2955215295da576451870c6385cece5d595337b7361ae97ae3999efbd201c1159c8f1cfae9ef13514bfcfc89c99e9102c857a0018c70c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f1fd528238a680a52769680f7d07a24c

SHA1
d78835e79984aaf1af4e2f1987ab17ab2ffc75c1

SHA256
06b3f29ba0eb1d008e05675014eb8ca5caae76da17147bcc81e152b355c33d29

SHA512
84ef391614e60b6dcb1aa3014ffd2d1000b71f5fc8ca8a30c8c3bb6ad970dbcdc241595c800a7c048b2b1b98721dae1c51f04ba1cc2092b203074f74c0a3289d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
370b7f08767e5b871938b0f88a19854c

SHA1
116fa1e8eba1cd448f508ca4e85519333cbdad41

SHA256
4acb92dd4d4286d4025f0410a49e1117d1d1a6cbeb7dd612add2f6c4065a4309

SHA512
39e391ea2692304cd0d2b55bc71fcb592f5226a42e593e5d219fec06b1883ecba5c45270b38eb8c90aacda1aaa4557b5c8660bb457bcf959d01e611e7019056f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8efeea720f4160cffea08ccad788f0f6

SHA1
5e65aaa94e3f6829f9fa3a52c413bdebaff4fa28

SHA256
030470171c70e28c65c321f4a86b3148f0e63f409040bb8c7b29bf50f678e5b0

SHA512
1c8733006634d9f35577e5babc7340a85711c6632a1421f9b17cf1a81af1fc14606db5a2832dff73379d579a13d8d5703f88534907afa7e00a4ec8cc791f6f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
32cb555f6e4eaf2b28d509eca24e7f9c

SHA1
0fe09ba90e8b6c0e67525a48eb9cea25e6a8aa57

SHA256
7b84dd64d2349053d9d0d641f66cdda18bf77571b221e9775355755ad3ed49b3

SHA512
97d8546e75bb2a6df9ce1e731172ed614abc8e9d7800487247b7670bcd75bf6fd5b5793a2208353359669f77f7c9cea9049d33c52f612af23ab6ace978d270b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0f23c94e4c252171268d2dc7195ac109

SHA1
a43b3105c856dea53eb4628200fabdba411ff95d

SHA256
979eec14cab972a469d5f1de5eb0869e9bdfed76b1c3f720ff33a18e3a6b84c9

SHA512
9d289b13a8ddfb12b62563b311619f82c23cdcc3cd621ae2aafaa97c8c4ad6790ea2e7364f34b9410af96a04f85b21c129cc2107c3c8c01af42190f68cd50d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e0f672442f6c29127993d0403e37a9e3

SHA1
a758bc6a0d0f792b5a54e4c2926ebca1522ba602

SHA256
a043c160220cc7e4fde8246960fd96b87bacc2619c15830329518a647e4ba76b

SHA512
cd09f1b583312fed97f512f469a7fd8e1a827793955c6c32b9e27559db793c8601c92b90bda0c4f516b92630fafd361b026f058e9895bd5fe973f8fb3f0a51c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
35b904ed7c64d76d058f23db30294234

SHA1
bc45f6d50c096c20883b622f3e1b433308f7fe89

SHA256
ec98509e45f1f0f426395ca3cab9ddbc7645be0da36d2fb3b6b1bf27c63c41e9

SHA512
3e63cbd799bf58b37ae4f73903454b32dba03206df4d2dcdb94f885266bdf580b1c9ae1f041eccd9477c897bee478223484de06ea57273aebe1b9bcf9a0fee4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4c0a67f843f7d7794899063c98a80ccb

SHA1
602c4d5d2272971b97eb9ffd90a7a60c8b646302

SHA256
6001c135e624b886b871f50e521b7e678be3b5f983ac761e7dc02555cc03fcbd

SHA512
6406b606d97c3c3d45849a54928213119b97932c141449d55a2e4d77bd07c63b6cb0045384633a3bff0f0e80888e72faca3738df554442d17e971e6fc86a038b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0ccde5b3cba94a569ed7bb3fe469d75a

SHA1
4cdc3ee046a584e818d1775d84b55eea20607488

SHA256
5d9c938fd85c2156f8876234d8313976e9b3f3745a0f9b5c74eb495f0f3618f2

SHA512
56f6761db04063e7f34488e17f95f4f10cb32cff174cf7a479455a008c3610d7bd023c4fefc0ef549724324c91ec6ce9b95a0b6d806351cc4f1a224579683b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1c5970f0df891c6405f717c12601cd50

SHA1
d97fb5291e600210f6766d6923a37434a88fd901

SHA256
821080ba404cbce23291a69b3ff6b594a46add2b69c7e9be408174c4810de182

SHA512
1ba7def898db14196ce8453cfd01e4d2ddb7166a34fec10f5ea557dd5e373ecd1c355fb0829cd25d05399c1bbf1f674a88245ccdba07841340184e37d16e2e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4e3a8dd55d89260737237b47e5158c0c

SHA1
0d1638f4dfb40cf7625f7d191ff10394ac4a0df6

SHA256
e555f0bc4aeeccc090d3076cba52e7dad57d5637c4c793a9cfa464091eb20137

SHA512
1ed14838e7ff6a82d31bb1168ea2251a7f5595d52659dba06dfcdac3c0e53bb6b4a44b4b01b2a327c60a21b4600978fc19a1269d7654c651c34867b1211c8482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d49c1f15d20a74b3ebd456f40519943d

SHA1
d7c03d32d0685f848bc73e633aa586b617cef13e

SHA256
e3fc9050479122677de4f5698fa846de58f2c513476e7f759a85169f7edfd783

SHA512
2ab143276acc40d1b29d194f006e769e589af7597b39d5abf1015ae7d589387690ec546c33c1320467e6ccd9d67b8d10170e73e464bd417ff8be73e1e73fb2f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804fc.TMP

Filesize
371B

MD5
239fb1e8f6cc260af538521a37da518c

SHA1
4fb4cba809fa4a20556a89450ea9b0be9ee39679

SHA256
ccb20ba9bc1174c2c1bf19a015ef5c400eb6306cfe81df5c3925e0e32f30da60

SHA512
53472fe92f7465412708b19acc0fcc44bec236ded224cda2aeb067bb72a44f497f97e3ba8dac2b7e0c36963fd17c9cab001b813fc6d762e07a681c2d13be366d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a35a7f96c30053e2beb27d790b1165fb

SHA1
8d6e78a4b5d27482f5aa96906f699f6b3b1ab16a

SHA256
47ab1fdac9ae5a0c17979882612dd9c019339ef78af0bffd7c2864b63944614b

SHA512
dadb3488f45fdf47e91e5e3391e94073bbb6cc082eca84be353dfe82ab66365a5daaf0978d149b636f4132cf7b207f485826c3dd04dbc2c163ef501bf6c7173c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7062bffdaf0a233f8422c2a627b30050

SHA1
4127729dcfb8b9e7a193bdae5861e30a5aff2eb2

SHA256
becfb298a0c5cb83cc95a5e3a1e0a3aee6550b724ebccde4d35b8c3b3a12cce8

SHA512
4069e72239c6f4f43ba331159438442883779674f913a3d0f269c10c7fc1749599d08111a2fec236a2eb29998176be99424a817fa16137c13fd8671feaccf982

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit