Resubmissions

23-10-2024 22:53

241023-2tykrstbnc 3

20-10-2024 16:34

241020-t24gzszfrk 3

20-10-2024 00:10

241020-agdlaazamq 10

20-10-2024 00:07

241020-aeqstsxckf 3

20-10-2024 00:05

241020-ac6q9sygpq 3

20-10-2024 00:00

241020-aarvbsxana 8

Analysis

  • max time kernel
    194s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2024 00:00

General

  • Target

    https://steamunlocked.net/

Malware Config

Signatures

  • Downloads MZ/PE file
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 21 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamunlocked.net/
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbcb646f8,0x7ffbbcb64708,0x7ffbbcb64718
      2⤵
        PID:2484
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        2⤵
          PID:1452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4788
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
          2⤵
            PID:3252
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
            2⤵
              PID:2560
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
              2⤵
                PID:1192
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
                2⤵
                  PID:4548
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:396
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
                  2⤵
                    PID:812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
                    2⤵
                      PID:3464
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                      2⤵
                        PID:2860
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                        2⤵
                          PID:4900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
                          2⤵
                            PID:5484
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
                            2⤵
                              PID:5492
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                              2⤵
                                PID:5932
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
                                2⤵
                                  PID:5136
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                  2⤵
                                    PID:2732
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                                    2⤵
                                      PID:5496
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
                                      2⤵
                                        PID:5772
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                        2⤵
                                          PID:5676
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
                                          2⤵
                                            PID:3920
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
                                            2⤵
                                              PID:5236
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
                                              2⤵
                                                PID:6072
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
                                                2⤵
                                                  PID:5260
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
                                                  2⤵
                                                    PID:5040
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
                                                    2⤵
                                                      PID:1948
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:1
                                                      2⤵
                                                        PID:6156
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1
                                                        2⤵
                                                          PID:6164
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
                                                          2⤵
                                                            PID:6336
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:1
                                                            2⤵
                                                              PID:6416
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8236 /prefetch:1
                                                              2⤵
                                                                PID:6488
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
                                                                2⤵
                                                                  PID:6560
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8396 /prefetch:1
                                                                  2⤵
                                                                    PID:6568
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8808 /prefetch:1
                                                                    2⤵
                                                                      PID:6708
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8860 /prefetch:1
                                                                      2⤵
                                                                        PID:6780
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9284 /prefetch:1
                                                                        2⤵
                                                                          PID:6924
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9396 /prefetch:1
                                                                          2⤵
                                                                            PID:6996
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9276 /prefetch:1
                                                                            2⤵
                                                                              PID:7004
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9500 /prefetch:1
                                                                              2⤵
                                                                                PID:7140
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9968 /prefetch:1
                                                                                2⤵
                                                                                  PID:1928
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10116 /prefetch:1
                                                                                  2⤵
                                                                                    PID:6812
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9348 /prefetch:1
                                                                                    2⤵
                                                                                      PID:7268
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10524 /prefetch:1
                                                                                      2⤵
                                                                                        PID:7340
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10476 /prefetch:1
                                                                                        2⤵
                                                                                          PID:7456
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10696 /prefetch:1
                                                                                          2⤵
                                                                                            PID:7464
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10904 /prefetch:1
                                                                                            2⤵
                                                                                              PID:7540
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11088 /prefetch:1
                                                                                              2⤵
                                                                                                PID:7668
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10548 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:7740
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11368 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:7816
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11072 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:7908
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9372 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:7984
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:6964
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10876 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:7148
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10340 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1352
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:7224
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11064 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:7416
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10964 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:7516
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10040 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:7644
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10552 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:7948
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11000 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5948
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10176 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:3604
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=10848 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:8188
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=9428 /prefetch:8
                                                                                                                              2⤵
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:6996
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9168 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:7484
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11004 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:7428
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9556 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:5900
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10540 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:7480
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10768 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:7504
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10480 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:7468
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:7520
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11500 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:7976
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6948 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:8512
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:8520
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12200 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:8572
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    PID:8912
                                                                                                                                                  • C:\Users\Admin\Downloads\EzExtractSetup.exe
                                                                                                                                                    "C:\Users\Admin\Downloads\EzExtractSetup.exe"
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:9020
                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                      C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell32.dll"
                                                                                                                                                      3⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:8488
                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                      C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"
                                                                                                                                                      3⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3680
                                                                                                                                                      • C:\Windows\system32\regsvr32.exe
                                                                                                                                                        /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"
                                                                                                                                                        4⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:8184
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      "C:\Windows\explorer.exe" "C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2860
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12792 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:8312
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9928 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:8496
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:8576
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11092 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:8760
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12540 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                                PID:8928
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=11736 /prefetch:2
                                                                                                                                                                2⤵
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                PID:6956
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:8084
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:8300
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5284
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3512
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10696 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6900
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1720
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5996 /prefetch:8
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:7296
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10808 /prefetch:8
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              PID:7288
                                                                                                                                                                            • C:\Users\Admin\Downloads\EzExtractSetup (2).exe
                                                                                                                                                                              "C:\Users\Admin\Downloads\EzExtractSetup (2).exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:8904
                                                                                                                                                                            • C:\Users\Admin\Downloads\EzExtractSetup (2).exe
                                                                                                                                                                              "C:\Users\Admin\Downloads\EzExtractSetup (2).exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:3076
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11848 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:7452
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2752
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13284 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4516
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11516 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3512
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9684 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:9128
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6252
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=12516 /prefetch:8
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:8200
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10504 /prefetch:1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5840
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5684 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4804
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12064 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:8724
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,1918619047132746307,13536622667706842755,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9704 /prefetch:8
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2084
                                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:1996
                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:7276
                                                                                                                                                                                                          • C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:6780

                                                                                                                                                                                                        Network

                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                        • C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          881KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3b67b6026237810356f5aefb373d2b15

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1a4d565f81195adb9c048f8eb7fa7d77018ee3d1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          554ef8f1d2b201421a53dbbf897fcbea20dbba9d6e8fa881ad0b52be60c11f5e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          4e4a7445b1580c2076174c336414d5918a3fc0afbb13d56d29bd1fc18ca114affad1ced06fd52624292012dff2b95a76b19f4e3f9940c2d9a333c290a95d4641

                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          55540a230bdab55187a841cfe1aa1545

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          363e4734f757bdeb89868efe94907774a327695e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          152B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          dc058ebc0f8181946a312f0be99ed79c

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          152B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a0486d6f8406d852dd805b66ff467692

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          77ba1f63142e86b21c951b808f4bc5d8ed89b571

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          91KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          39a4d0b03799020307758961f4199b19

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          74a4e6b0223643361bec8d4b26b39675cbc3e565

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          90d6afa2c2052df89b0522e51b8c98cda61b819e2b24a75c2c0fcb218bc451f4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          015a1be54de12ab28f14b5cfdc8def812c7dd5202b5ff827ad6b3ead493d2caf3e6b52164c3cc7dd1e5c9eb85b8ed93b6f55b242ae630e92ee78c4e01ce83b78

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          83KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          95ad70b0720495f26f4b7dc7aa152c13

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d325d177460b579980d6b36a4da2defbc709d6ce

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7d40765179bc45d7b2a36b9f0d49d12c2048abb154ed0ecfaa2433417fd0cdbc

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ca9f7e4fd11ce28a5eacee9cda062c8418b4d6cb440ed82328c03d7c1d1835d7aa175a2ac5e35ce2ec3ab6a37ed2fae0bf2eb61c7b08199299b6dae9e5194fc6

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          67KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          929b1f88aa0b766609e4ca5b9770dc24

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c1f16f77e4f4aecc80dadd25ea15ed10936cc901

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          62KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c3c0eb5e044497577bec91b5970f6d30

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d833f81cf21f68d43ba64a6c28892945adc317a6

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          63KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          710d7637cc7e21b62fd3efe6aba1fd27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          8645d6b137064c7b38e10c736724e17787db6cf3

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          19KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          2e86a72f4e82614cd4842950d2e0a716

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          106KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          60462d29cf50606cdda8d5057fd4de28

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0a7f8a6daa9233d860e72407b89f24e8df3f26ed

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          08e26ddbe3dd98e08fd88597e1562975b062669f95dd7df634a1fbbd70f30721

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b63359cbd0434cbebb55c8bf5e6c70fb2dd28b850ec5f96e7166e9044dcdc887935a807d79e9fc2d292d77734166a050afb306d45941bd615d11c4cd687199e2

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          47KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          015c126a3520c9a8f6a27979d0266e96

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2acf956561d44434a6d84204670cf849d3215d5f

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          337KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          2f1eb7d86ace8fadf0bf9f04728e6343

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          fe0140afe94535872485112ef447c29e0c3eb344

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e1ef030b6c6fe32f650f1e1e01c71a230ca38f2d2aa8d4da0f16521838bdaae4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ae58237b88c1082c318f772657a8f382a5e2cc3ab676a89f3ea31e71234d3757091ac3a3a2b88e3a857cb5af0da6fc7ccf39f59fae810160a3771ea867573473

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          3KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1d334cebc2639aa14373bbdc1d45a2fb

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c432f287f7bac5d793524f88d5eff3f40296245f

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e014b32a3aa72022087309221579debd435a545635fd2160002a681c31dd2085

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          cddaff054b4f3167ad760614f6ec39f12bc4b9b883cb88372d47a39075fb414b55c22ccdc7661e09f4dab9ed5e2de02427c532e9ecb7f653aefa4aae89ba0eb8

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          3KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3d0cc15bc33d6ddbd9a1b7a986e92129

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e95dfdb6e2186aea7bce10c1515c6a5d2afab48c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          049941a855916a6c0b2aeb87188761d6061b4cc1d80504d68d0712cb06060f37

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          839a3ba5e49490017c7f6962f7dcce76f290e5b251e627cba955814da0d9c6ad0ddb2b344485d6e6c89605089d399ef576409673a06f605be62b96629e7b2361

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          3KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          30903e0d5f78035c86dd8024f1ca1d64

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          701372f11145dc393112af72eaaf759f69c7cdf1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          19a01fbb2f00fb09418c72e2837478650f82c57f156352375cf22936e40c3eca

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          4fb87cd488d93831613e1c43a27dda4e9820ebb39c68bceb117b03ec72a178d9e14f5dc9436e419238fac7677573d633fe6b55ee43479950c5eb4ca8f1dd87f2

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          41B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          17KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          aecb663d8cab603ceff4d907a7d95946

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          cb3b9ea6f80c0e257ce87428d76715809c3d44ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          2bbb06d40c72fc14ba6db2be10c940a078e7139c25498a5f0772b62992bdea08

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          443ec85639b74555ddcddc233b9a48f4287d0332388fc5263611fca8836deb187f4f06a2f2f43b752df3961c76788b30bc86054c9a1a5001d953fab90ef4c645

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          17KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1dc97cfd0151049d0419bb0cc95a59ad

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          f7f58e6f9722000e1a7ba7abc98953c35b8840da

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1e228402f05431098d28d2f0280f98e768e05c850995019f80c9d1cdda530f4e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7abaa333fed0f3db945c911b3eb0db23b708377a4ecbf764ffaf91fd811cb961ee73a09edd58c6925b665d2303db3f05ec5cac3e42a75ee5d7b94358bbfc1bf7

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a4b1de3bcc0c341817a6184283bad426

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d1c16ced9e2902fe19f7bc8ccefe32fbcd3c7131

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          683584887e09aa02f6dd622cc288d5b6aae64fcc0bac8b49fe0ae5add223750d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          3478c81dd40506180f25e0b2840fe35ba60a21d68ee36e443c7fb3e9228df91d744d0d515d0ebd019edad570f1cf9e587891b314738d94a3ebfc952288e7bc83

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          18KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6f82ae4fab3916a30aa2de52f022dc59

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          5d9bfd623be0be4d1406173d795b68d5300c411c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c2d206a851047d944a6ecce7316daf0792967b57d21a4ed25c65c3707d1061b5

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d721464b77cb5bc723329f76df1b565ae61b853bbd679fa678f3ab3b5218ae488a8d3d30ae4097f3fb9fc2a90cbc5f190911e53bb01998eef35362a119744435

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          19KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          aea8c09e62b223eefb30bbbd3e807cfa

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a3a16d68da41be86d3519b56cb343262c366fc4c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          30b1eea534be28c7973c49e4d1dc941679525011ab3323efcb28bd9e750c1ca5

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          093a1724dcda83619328c80ee9dc1a00ee6d25d7eb7fc1a87c98a981b7c0ae45f92ca3047192294fe3e074d45422ac81b7d487a3836ce60cddb7996c0cb8135f

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          cd78d4f69062b6c3476c508f89a72a02

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          af0b3a4404e87b3b11f571bed25701407e054af3

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e0912e5a8aa7658ad8a7f15fe51deda39ae6e143ba2251c208def189c32c6a3b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          04655942a3bd02bbdf06b5b5fc5c955e28487bd326d389e40b84efc19911c17ae3f711408aed5fa5c38eba7d99af979e18cea008b849837f74bf476e3018aa6d

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          ad8d0ea8c11a6efeb4ed228f19e85e04

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4dcc9d80083653c4574eac35dc218903b3176f97

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          65329b5801b22ee7a76c707084c5b922a8ab9d616b56e7c22cbf43625c15774b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          22ef37fca5f364ca464f8de798e00a241b9096a06b793d38668e177fecd9e23e0e130d244b619f6314602e6bc4c050f03f4c20bcdff1b3e92455b7cdfaf88de2

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          6KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5ab9845b0f2f7653054be576aaad6de4

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6a51c66a1d160525764ba7dbbec64a4dc2163d11

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          84b362b6bcc80f58b4ae188e7e5c9322028cf199aea6d110e7d82bb84092252f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a3b4ac6c0c9bedca357d18e56ba588d9c7ff6b1a226e1382f32d05e278a858aa43a72af1f5761377c662a3ce107eb87f1e22540c89c24c67196d6982fce356f0

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fc30716273cdb160ed1fd5d50a507a6a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          cf4e9d033cc2b6d8b1985849f5a85650bf9cf866

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c81df2fe4462a187c6f0c4b6a3c987f8b90fbe40db7c0adf662ce1114ca3f407

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7c25d6b78d9ea41c0e826e688f9d36949b6c999e21ffc5f07be66c66e2a2e3f299efecff740dccf0a3f0d01bf9d4b6861d1ebb3daee60eff71c73da3a3866367

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          13ce42270878bd02bbb082d11a66cd2d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0342e7a00be2f8dfbe955abd62f40b5ef8e38400

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c11084c2d7f57da6ea16eca057c8485762d9bd4afff4deebd2c0ed0218709e3d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          66d9a89011b65ce56809de4cbb8e52daaffc4335220cef9b17594ab9c6a744bf62625322497022747261c67a3ca31912d49d5ddaeecd3589a786058f30cacfb9

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          6KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          2eb589db26a461deea762c94f1a1742a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2b5c6fbfb2f24e6cb14e8c0312fab4b90d7d5afe

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          5a6c53dddbdde9a4f4f960d7898cf16ec3ee45112bc6c44f02850efee01e4708

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          dd79168ab6d72c8c7c27fed076f642cc888d05687f2f333d97e993bad4f28957322a9a997692dac92be0d63e1e2b6a73bf47ab02b25dc64cebaaa297c7847ff9

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d498ab3052e87e49833c83196634e371

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          77ffad54990c7821e71b71da82eb27967013d6d1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b936ae4ec21465e6dcd2e57357c13145f9fda11c2741d7c368624036ef2b8a4f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          47f50b73e85c088a43ae63d376e8549ef32f7169fc03e87a6c6a294a1b049ab9ca85e9fc28d859cd49fb3f4a43ace87d52338c7b28f3be8624035905a53b522c

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          2ec106c3ca9d382bec41ad8f80a9a447

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d09a29da6863f8f06953c21470a274aa4fe07d9b

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          6d31999f65a28ce0652870e1c9c23f8d3dfad57503c0ff975326e6ae353ff1df

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f069eb8e45678786a2abda0e50acb7798e3c627cdbb69cb6d7366abf740ac7ea55622794a288e6ef579341334b29d20cf0d23ac07c8223c389fe2471f6ad7fd8

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          16B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4cfdf961f46b8e8e1b1861e5dc41173b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          340f370f4a3bd1086feff50772f3c0b9b544f7ae

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d9a6b0dd794016db5cba73545744cb12538935c462b97bcf704da43931d5e9ba

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          3e7a4d4729e884262a639f7ff06502837a3918461809eaa98fc4607bcc21cce7d8a860c20dd1ea0221d39f411ab23e152a86648dbcff14b2026f468d7cb856a3

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          2a068713f23bfd1c0a6806f5fc2e2ab5

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2f564156aace90d6287c1b1dcbd734e9ea29aa2a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          91a24b34e26768ab8f316c6a0eddbcc8ca4574bfb51694bc6f99da7a00279e36

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          6db6dd504bcda6ff08657b4675c80858b64e634c5af615ee2de6edbf65c62d3e78c37466ead950b5b732f31e3c93d86ffa92dd8e96544c4c9d5b0169782820f1

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5818f2.TMP

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          48B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          0fc9be5d6dd06f86db4e035b256aad76

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          60d803c9cb91af8ee2c8e129cb313c0ce3b3af1e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          04762fe12a07124a1e6dea9064b973e4c2a31ef9ca5d62aa2c62d2ddc3b21ec0

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f3cc3bea704fb3bef50296442d05657b361af53cb15a0736f75e6700b12811739a3ecfa98759fac597b7cc589a1d26422191dc84da495543988ea4d6fd2c24eb

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b3320186d0a8011362ace8ca30f69dd4

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          530ecd39668d05c6768a3cf2adb946fc92ceb1ba

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          6a02dcfc577c3751eb8da371d1fb66b15d41dcd4b97d963a1fdbbd43e79928c4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b1582345d309c8a668257eb6277aca224a919b785fdabd8a0cc3ee73ee63e3b18aff4740db95e71b0cf14e2f51f08b8da8fa41e7cd22a7f660d6327598af5989

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          542cbf1204053c207fdd4229179b4532

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          07d6e41450bc9f6059d0888d82c67036251c9dc9

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9d85283763bc7b27a4e600c007fb811bc81b6603580ed0f69f6f23f2f68f0d00

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          0db2ab963508ab6f9b9cc94e107f32a7206aba713bf800708fb2bf997c9daa07de8dd830e78702540c385da60e47aa675ce04c3e0aeae2a2ac050359156ba2b1

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          6KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a684a07e5ceecbec6099f738cddd62c4

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ab9a4a0a2cd416a429c86f9bf1f8811b18ef7dcf

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a9478705cbc21f8b65ffd5326e421c282ee2dc771f875249fb7c66c00931ac1c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7f2e07accc3394e2d2d44bdc54c0192d36a5a13b7e9750de91d02e6b3677be4c59903de04c7e575a7c8c874733d9481d6be49e8b72865c082ca2ea1b31757842

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          dc1fee224c580ddf753a31e21d5cdf38

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          5711055c2a53f2ac3fc0163178a9ed09ef629502

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f3f93c6a489928ea59189e4fc58371e3c2ccfd65588c3e5b3779677b4dcae31c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7ab4669535633d029633ee94515ebd1216811d20c1ceac9964cf30fe9e7c808ffee13b0d1c7c999f3e057abc4a62321da60a66705f4ee420bd3578d9dcf02031

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e1468fb8ca1ddac144d8f58781dca241

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1d08bfcd7939241f2408be53762205504ecf5460

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4596235a0f9a644d2fd5df1b33f49a5b726375ab4dee0846baacea73e98de32e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e17d256830aa8b3e37447cf56e9ec6a3836d3ac0352e502f33178482a180a964a134f460c97d14169f970bdfbda9df1ddd2cf56f906e0a19e8c0c2ce35bd9e98

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e995.TMP

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          371B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7a34497feb0f0bc6eb85ff082e925501

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1776202a9cea6115faf0d06273e5efd9aea48421

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b86761ccb754876982f29626a8842642bb674df8bc7f7272a82a0bb4967cf139

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2eb99ab2c312c033c8db12cc1940e38c7681a2b3c38ec6dbb54306bfe9888d6f24beb14d32f8be1c9aae237607b76245e8880c51af6dd29a61cf8b98270404f0

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          16B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          11KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1b2f528b32d7f07b4a3dd4b2f764d9cb

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e52d2a6e645cf03e837adc2b81bd1ef54307e38e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          5ba514b5a8845f9c3f03110a24b7f25ad331b1de89772bf8f5f58759a1282ea3

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c2d649248442fcb791893fcd7fbb880711712bda88bc45cd52e23c326e5f5cb2258deddf3472fee45a0a6542c6cdaf12d37d722b666443a1609d285dae8f5929

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          11KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fa1209d7e0c1002a8db4b97043cc1d09

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          9247db6fa5448237bb83c536b5126c810bf18657

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1cc157763aa5092c7004dc78c0f4ca19d27bc22449f2461d8b5764f911c421e0

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e79ae389fe60d686cb80079d66f352ee305ffd32b5c42dc175882edac52300c32675bac52b6c923c5183a57b67ceba3f7e0a6724bea5162152794f0f556a0b8d

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          12KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a68228c0939a76bc050de2d162213d16

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          535a5572d5846a78aa82c1a943ede2d4167ebfad

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7866fbac45b678e1a6e3b6638e3984198818f7f43006c7fd006409b143ac01b7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2b4b98bb6c75a440635fe0212e73f289ece459991b1c0e0b05dabaa7df8c7326059d53684f298c0195d8aa31d4a34843f41fa0319d1f44c614d467c575dff914

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          12KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c0051c6389f4b79bf66374817cbad1b0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          701f8056b3f8efaa8bf2d83b8251888d83814a75

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          69288fbdf6752896d040f22445e4da1e7405461692a2571e3b9d2596ffa3f21c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          40fded20d33efef156509d768217fde72b947164da3276847a42018a72f4b9b24f7321e1ccf63b779b5543695fc1af3a8bd3123debfc2d817ca15321f4a09cde

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsl530F.tmp\INetC.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          25KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          40d7eca32b2f4d29db98715dd45bfac5

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          124df3f617f562e46095776454e1c0c7bb791cc7

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsl530F.tmp\NsisPlugin.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          280KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1d0e98e6817a35237509731e1398b47a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2690a72941f1641495a1cf51ebf5399987a74e5c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          23abc9395b36419700f31b507f13a189ec2eeb70c7e1a1fe9406c2b9e0728298

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5cf919baa11e3cdc3518a351e206a5dc84bb1beaf933194d27fb0a96edbc6b90a58106c45a357e8c7af9de815b4e74cf5e42a22bc91b5fac02bb386a6638d0ce

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsl530F.tmp\System.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          12KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          cff85c549d536f651d4fb8387f1976f2

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsl530F.tmp\modern-wizard.bmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          25KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          cbe40fd2b1ec96daedc65da172d90022

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          366c216220aa4329dff6c485fd0e9b0f4f0a7944

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsl530F.tmp\nsDialogs.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          9KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6c3f8c94d0727894d706940a8a980543

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0d1bcad901be377f38d579aafc0c41c0ef8dcefd

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

                                                                                                                                                                                                        • C:\Users\Admin\Downloads\Unconfirmed 26233.crdownload

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.4MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7399ebe1e1b9c99f3cb4a2521d424384

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          7a560782421feb72b1e84f162cf0abd0809fda28

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4704846c5605552a2573aeb62f176630fd2ba5498457420c3fb36a27cae6800f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          80b6b5b2a93656211073560e3eb93063edec44d54a4346b64cab5898162936d3109e7d213d73a93e50ce3a20d163ce6f8eb27e3f31e72bae6c684e528413981d

                                                                                                                                                                                                        • C:\Users\Admin\Downloads\Unconfirmed 598058.crdownload:SmartScreen

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4047530ecbc0170039e76fe1657bdb01

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          32db7d5e662ebccdd1d71de285f907e3a1c68ac5

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

                                                                                                                                                                                                        • memory/6780-763-0x0000000000ED0000-0x0000000000FAE000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          888KB

                                                                                                                                                                                                        • memory/6780-764-0x000000001BD80000-0x000000001BEC6000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                        • memory/6780-781-0x000000001BD30000-0x000000001BD38000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          32KB

                                                                                                                                                                                                        • memory/6780-783-0x000000001BD60000-0x000000001BD6E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          56KB

                                                                                                                                                                                                        • memory/6780-782-0x0000000021250000-0x0000000021288000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          224KB

                                                                                                                                                                                                        • memory/6780-1292-0x00000000016A0000-0x00000000016B2000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                        • memory/6780-1293-0x00000000017C0000-0x00000000017FC000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          240KB