hxxps://oceanwave[.]lol/

Resubmissions

04-01-2025 18:14

250104-wvprcs1kgz 7

04-01-2025 18:10

250104-wsgmza1kaz 10

Analysis

max time kernel
449s
max time network
462s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-01-2025 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://oceanwave.lol/

Score

7^/10

discovery motw phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: currency-file@1
phishing

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
305	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Loader.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
568	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
1860	msedge.exe
1860	msedge.exe
2044	msedge.exe
2044	msedge.exe
1096	msedge.exe
1096	msedge.exe
428	identity_helper.exe
428	identity_helper.exe
3036	msedge.exe
3804	msedge.exe
3804	msedge.exe
3036	msedge.exe
4500	msedge.exe
4500	msedge.exe
2172	identity_helper.exe
2172	identity_helper.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	firefox.exe
Token: SeDebugPrivilege	3368	firefox.exe
Token: 33	564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	564	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3368	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1404	1860	msedge.exe	77
PID 1860 wrote to memory of 1404	1860	msedge.exe	77
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 3580	1860	msedge.exe	78
PID 1860 wrote to memory of 2172	1860	msedge.exe	79
PID 1860 wrote to memory of 2172	1860	msedge.exe	79
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80
PID 1860 wrote to memory of 3520	1860	msedge.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://oceanwave.lol/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb03c3cb8,0x7ffdb03c3cc8,0x7ffdb03c3cd8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,8401405948373321745,8922079288006879557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3144

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Loader\Loader.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43204fe8-e546-46d9-88ef-9eb33fcbf222} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" gpu
    3⤵
    PID:3860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2344 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2312 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26f314e8-367c-4b0e-9e0e-6df56d0cdba6} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" socket
    3⤵
    - Checks processor information in registry
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 1 -isForBrowser -prefsHandle 3100 -prefMapHandle 2952 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acf25450-b12c-4244-8df9-90584ba841ac} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
    3⤵
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3700 -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 2920 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4325d1ee-ee2c-4eb2-b6f7-9b405b00682e} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
    3⤵
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4100 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4188 -prefMapHandle 4168 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afe5fbb9-79c1-409e-a2cb-14ce276449d9} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" utility
    3⤵
    - Checks processor information in registry
    PID:2584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5384 -prefMapHandle 5388 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac56dfa3-0a63-4bfc-9e3d-9ec022372252} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
    3⤵
    PID:4948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 4 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {363ca374-30e3-409e-9163-0d8d66c9ac39} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
    3⤵
    PID:4972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 5 -isForBrowser -prefsHandle 5748 -prefMapHandle 5752 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ca010d8-8f62-48fb-9cd4-26a6442ea73f} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
    3⤵
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6232 -childID 6 -isForBrowser -prefsHandle 6228 -prefMapHandle 6224 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d850974-df01-48cf-b72f-a4d6c2f51307} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
    3⤵
    PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb03c3cb8,0x7ffdb03c3cc8,0x7ffdb03c3cd8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8344 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8484 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8740 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8876 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9188 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8604 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=9416 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8512 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9460 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9404 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8848 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5616 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8844 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7720 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4432377483118079883,12678249819475152717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8588 /prefetch:1
  2⤵
  PID:1932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
1KB

MD5
c6150925cfea5941ddc7ff2a0a506692

SHA1
9e99a48a9960b14926bb7f3b02e22da2b0ab7280

SHA256
28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996

SHA512
b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
276B

MD5
d939648e2e53453c1d990bb105444013

SHA1
75e902d950fcecf8a41a552aee06c7e679a59c57

SHA256
caec7aa25a2ba70e29e2a34d182eafd96ad238019eda085041cde658c675b6df

SHA512
a51fd197941506bfc39fba7fe325cb70908bf87218d3fa5e33ee9a0b4b5a76701735db7ec1751c72ff8703ca1385e0b0f71ee9a7a8a9f5745e3e0a5219de4355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
852b3c86a6d00a8d3060b0e512794602

SHA1
587d453d6f65cc18b93d7a337aa8469194cba20a

SHA256
4c284c3b63994d4c70b60f8aee3eb6a30299524a3069fd7a33b163bdef47d8b7

SHA512
5714749c9a80abcda6b4afdc2edd387d486d0011799e19f597a8a40be98cb2af405eecd0d38a39954f772b68508642c3ea51cd97e50222d3d78b68652783d683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ad92cd4f23cb4c9aca348dea2ec6363

SHA1
7ffe3bc242a16d616668c46531ba45b9b8409cdd

SHA256
b4f9094535a0d97ad33d2a82dc9495a90f80f49a8ffc21f579e1713736b73529

SHA512
6d2b711739bfab13daeebac060d6c9b202d572ce2c8901092e6967ced1cac97111d040472db81b30d86fe8279a4433240b6393a832e5bf67a73619fd41187312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
c644381b62d2aa17b8d8a8ce58c2c008

SHA1
983aa8714de4b0e840b9e3e393837a2206806907

SHA256
55366f6965395d3f23641c8b818e4939b97435418280887e2813c8977abd1f39

SHA512
27ad6e40db636c2b192a74198c432428ed32dc67be563393611eed825d7d6465ee7ae2ea14ad2420ae0b4e72b60f1e0bf270a4ca6e7742eb2eb4f339002b97e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
a1beeac3de475c45640738429ef57a6d

SHA1
d7b5ff6a55245e220d0afd8803a538a40a061907

SHA256
fda86f4125fea2314ff8d59dcc06a58cc905128ef3f9db7561690b6a9cb4f49f

SHA512
1a2105bd2cb9f5b955630a50e9f44741b9fac7646ddd19a67bdd2f588cb4916d37a860b5ffdc9f3e15ee5b687a8c89c9858eec1c189374dd6d69bfa1fbc9c771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
94f22f1745c4bfa0d389b419e381051c

SHA1
12f9027532a498a341d63176de4768256e9e93c8

SHA256
9e80d671c5ec26f73751e6162253d7ea4d1b409dfb48a2d3e442f476a1cfe24d

SHA512
959cf18c72146ea7f5dee1edde1acccd109328ef5dca4187524a21cfa9e728329ec29c136f39b02142d0f7d4ca07b449dad8adf306c0d38e54297468d51778f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
abec5dddaf0b432eaa3068b6c4c65147

SHA1
5594456806477de24df1aa89694ed90620921ba0

SHA256
c4d39087aabd3ae4eead18381b1f531bbc4aa06372681aa809e1ecc82e16f41f

SHA512
ea537f216e61d1bc9eef82cebbf13fafb4468a71434f2aa4593c6bab38b76c6620e895e8587ea01468489ae9275df84ae1b2cff982a5c8cba352f9b5b6a98d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
67KB

MD5
b894d568e35cad3b0d2a6686bdc65131

SHA1
b9d283cbe35ff44efc65c05caa6aadd4a2404f13

SHA256
8f4e6850ad2ee61de53b3b22714d53613b8cfd7f288dafe8b3ca1857841bd1e5

SHA512
4d25cbbef0cd92f1ab03ea0f7b46cf34a9d523eb728309989ed6ea24f781feec37c494934efe9d5a07b9003f353b1f4a73beecf0e71ffb647286656354516f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
62KB

MD5
35fe37e08d59a3191e5937bbf348e528

SHA1
64555d7ba585935ad7031b1dcd85e32d665c5e19

SHA256
e0050b274222e7bbe0d963be219a27e4a47fddcf1a72da32f744a04eccf91615

SHA512
ef3b2acc746dc86ce4e9d075c133e0b65277c14c6347526e25ad5ede7a0f9403478a5fc6a2a19babea02012b5770de1b7484e68c1dec64502d362f8197289f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
31KB

MD5
00bd4556d9672009a7cce0eb5605fd1d

SHA1
e6aa062aa34cd745dbaa2b0fb851511a5ea734dc

SHA256
11e4340eefdc92053fa38149176a0c17f55472b8fd3897426a76050aedcb8621

SHA512
34f87481e0cfbab27750b392d885092bcd6e11796745b5ef7f39e9564b8d29d169cf8d72795e45745c366c18057d02120726951d2729c699bc60e6518499536e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
138KB

MD5
e651db662d962565f8855a8e0b083f81

SHA1
85035d0a747c6913593b2fe0a35f36195aa61712

SHA256
7f20e2dee43d28e7149a5f07107e56c4526db825e9df94662456b23e46f65494

SHA512
9a58a7076176d177d3da4181a19653ccc4d02f3f2f4a161a9d7e532b9e9eb322c6bd54450e70f98d590b56ea7408c0063325f8da5ae873a19001af75944f8aee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
36KB

MD5
9a56f4eb7af045f304951ceac625d949

SHA1
669b2ef84c7cdd419c9dc893899f429fead33109

SHA256
0b81403335bc3a5ad450bac7ab9c397da343fb3d41aec9cabbce5bef4e03727b

SHA512
91666500a50f49fbae49bef7b531ad9bb816db1ccb877f36313f4db5621c871f83488f24390524868d2160b865e4ca13d170568e9b2c410151b6d7a7d66d42d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000057

Filesize
59KB

MD5
c082935421db88c0f7e4577be322cdd7

SHA1
8a170f7e425bccd8424fc3c128420611c21ced14

SHA256
58181a304b9bc3965b304f7a028b786e07d61801c15305f9fd57487940a2295d

SHA512
6ffbd30d88b69c07b8fdc8a27b10a8bb105adf0ba03f9feb21b5cad294e9b25d1db30cb00acba3db4149ff4b47f9c3359a9f30176c2fbecef3288a3d3d35ccf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
20KB

MD5
6475a4afa02878aba743451522eb5e43

SHA1
c0f8d41970f233ab9fb258b06674d1df7bff58a9

SHA256
db13973812c4dd5f62d6885ad06ed9d86f59089de6753752618b32be56d72fc3

SHA512
a016fd71ebd5c38cf4c4f4fcff4d0c555e86ebc201b8da4cd29e5f68162ede89922458495df44b05347ad62c76ee9f82f3147bfce1e5b4bfc5d55332de3119df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

Filesize
67KB

MD5
bcfda9afc202574572f0247968812014

SHA1
80f8af2d5d2f978a3969a56256aace20e893fb3f

SHA256
7c970cd163690addf4a69faf5aea65e7f083ca549f75a66d04a73cb793a00f91

SHA512
508ca6011abb2ec4345c3b80bd89979151fee0a0de851f69b7aa06e69c89f6d8c3b6144f2f4715112c896c5b8a3e3e9cd49b05c9b507602d7f0d6b10061b17bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

Filesize
169KB

MD5
2f9f85b052f6e6b3710e16a04ca05bad

SHA1
1caed44abd731e89b1f1f5309c8d5416be4613aa

SHA256
48ae99b6c8ee6fdadccd4a3e045e31d8b298b3ece5a66b43686178b7d855ec06

SHA512
500748adabd125bac08460ca1b9a1e542694cf9b663c7b3b2c94d5dabc24b6feb57650d3a8a8afb34f3f76514caa0cf30f705e7534d02baef1eadba8aff66117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007f

Filesize
967KB

MD5
89f124c8277b25d8c834a70c95b9b025

SHA1
6ff95ea57cf80d074bca93da30af77e3ccbac01e

SHA256
238bbef4b0de8bb73a3851329b4bcc7611d9d6b48c1b1d838da0f2ddfa94552c

SHA512
61f386d4be9160ab275dfa32097534bcd74245f9a7243c606736df6b7b8a6548e22ce8f5e00d946156d2d9733724330bbba771a784c584a3dabab32499f3c6eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000080

Filesize
1024KB

MD5
d4eb6cf732cd41ecdaea055f89066a51

SHA1
eb1ac10cfbaee6528a06e32c39222992dcfc53e6

SHA256
6c409b371fe80f7f720428855e17f51cef735e123bd484699d47c781fcfd5867

SHA512
1f59d9181ad35fe33d46f2431359f5bb3f8b720854e48e0e590ecc5d5856da9ce78d346c14159d89934fc3453b0870f9c7f0b21625e54860b9abc4c65027de14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000081

Filesize
64KB

MD5
e6682c58f62258aea14d8b16dc7c2eda

SHA1
86a20d3ae9cac6af91fe93ff85c4eb7780982387

SHA256
6b7ef4f89316d4c3b6070b437e221629e838c64ce9684e25f31ea3d89ccbf28a

SHA512
bd047837fe111287ee150270ce47069f2797c526c35433e86ceab31e2e5e505e2a0d5a008d229ef18ac499ff74bd8d533da5fc88cba606c22fae4a46b9286fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000094

Filesize
40KB

MD5
36b55f815a1400c968d4e6f343c2afc9

SHA1
bbdf4d1c0a791348afa733c1073ed143340b0d4d

SHA256
c3c814491fc433e8a183d8194872c3ef11cebf2e8c23c7cd11a46b2959d4cd3e

SHA512
4a834b8d693a4b079292185789a70add4a8d2999ada5a59e941716dbebbb58a806242c7e71ddcb8701b26704811f73f75f979cfa03261d0814e0abfa59d7f266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009e

Filesize
40KB

MD5
864de8cb08cb3174930a0ec73ec49578

SHA1
ced71ab9e254b483fe34cf0443f8f0e8036b12ca

SHA256
109bd15073fcc28bcdf49690acc8b9d19a63866e72338261421102ad2fda3892

SHA512
fddaecbeb3d995c59eb872b6ea43790fc47c01380f34d05b7d7000d1144f603e26e189d3aa604d9788f130c8bc2bbd3d345678bd79430fe8c418a574c3d9e569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a7

Filesize
64KB

MD5
5cc49539b4263522a10924005768d6cd

SHA1
036439b82e0239784e84b0b16b9f1075e251eb20

SHA256
0e97aa196e96de345fabd1ab4d7f89af6213f626c93ed62730e80642b326b77d

SHA512
bd5edbbe7b01f433bce77cd4c44101457cef52becf79862e298642e78ac84d6aec934a5bcdc7f215e819d3bc2846883595119eb3e340c7dc7b8c1525fe84deb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61ee6010a7d30907_0

Filesize
43KB

MD5
16e3883c9f1e59b5ff61f2ba50454677

SHA1
2e087129d5e9bc4335f37a5cab6ec8aa605ada9d

SHA256
264ae8276c1499d76d9d5190873d0815e8907d72ebabe8990c026b94b7011471

SHA512
e05c88bfb0111dacf9cbbe786d52bb8b56b6342a07ad56c33b4e8b9c76f76ffe3f6299855c28058f1a5e3a6ba0e2c58a315e56edcda4675743086ee76d967661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d16ea56dc6183a49_0

Filesize
22KB

MD5
257aa50faa3f561c159f83fc29b36471

SHA1
d1818a3a14b6b108967665f135cde9ffeed0d46b

SHA256
7dff49cb23312b0bd52e44953944f1298f8a9e0b17b1890bb2126b59fcbaf9d7

SHA512
d10464bdceafb0a0a1cb1398f707b8ef52dd3702268190961b52db9c2f466008784b2087f3021f2f71ec8a617a1ef573bb03111628990d18b8a33335a1976563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d6d9194197600691_0

Filesize
37KB

MD5
ad89de0bf727c3cf342eb795a50c4103

SHA1
f541a1753b627a85784cb92544939e271653d203

SHA256
3166ab5f2784801a52dd88fecd64ce474c8b6d2ec915ab855ae14dfbb185130b

SHA512
cc0f93a21e756c354d07f5d07d1c110ec61f61ed5023cc8bfcf29af8951ac05205efb5e236d8eaca6d5f6d362d52162409a9fd359a94c8bd872fe66907f23717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbc8bc369d771902_0

Filesize
55KB

MD5
4ff05ef341180e5347c9986585d7208b

SHA1
7d81a2481c54838efcfd848e3fdaafe71a8e051f

SHA256
5c9d51a9c6c24621610e3e3db574087b222e484e3515826b79525b65721f28dc

SHA512
fc354d997a94540fd8484cfd24c8b05667dc2f79386ea25159cb07c94ac1333c7d70691adaeb8ef8c1c7c1cb3a0743d7ed7f78764dd14fad27a3ec2689edc861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
87aae59a7c42f11ed27dc61a73612a01

SHA1
72be50bf897e38f1d16fd6c9ddcab8c21cbafc51

SHA256
e495729ec2129868c131f01ac344f87415ea1527ab7d82a5a8517a4f9517e499

SHA512
88ac48600fa67fc41c63f9bc947c17b1548114f9c493cf58c6e64fb6818166dad8db081c9465845b30d0f6482c7fcd765e66c6fa4af25aff3474031f612c7e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
b98cbf54e107d54e7ac7432f19044954

SHA1
2c9d0fc37bc98c4c8e213160a38e7409cc35c294

SHA256
b014e1a1a5f5ebefac01dada8783e09d39f22fae855ca4ae10457a3dcc6e32b3

SHA512
2bcac3deab2c568a63e239e96e5fe838df122680388bdef53867d9b5dcf80b060fa229954e46b555f9f2f9a59bd2e35334d9d5a74696cfd00069cfee398263cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f8fd3320cc3e2545ff7c6cb8d6f16b00

SHA1
8befcabd3bfcb027ac07f92b485950abb0a2c37a

SHA256
8aaddac6f544b5fe6b9b460d8802d340c889f6fdf2d7a85d352eace9b38a3414

SHA512
1741a7a22744e5c925cd741bf13a1c60bbd8f953d8f6da425a61bbaa8ffb5117aaef43c29122d060bd4a3c4def5df846de4d97e9692aaef7ae94977dfc12dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
13672aa40d03b4d072c52c321fab6af7

SHA1
9ff248fdff53615127bc0ae8bfc6acf55305d926

SHA256
d421a6910f7e0030c3502671b6f7fe8add5d50235fa1650261dd6fbf0c8708d1

SHA512
1f9698ac80112ee9f4a44dda4111e5f49bb168f22cd55c79ad740b301d1229a1855ebe7ea9a096ab201d18f78564707c0b2bdbeefd285d786e610a6f500f1e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
8ea417fa8bb61a2a3021dd3cfea01373

SHA1
726e102dc025838bb47fa5a0a278a6163cebbd1b

SHA256
3ab9041d7e34807a4237607c4c267939e7eadb7010b476b5f506c6349aa00759

SHA512
0a15900f7f83a77c890615d32823b5e92261563c252a742a1afcc45e1ed5a88d22745a67ddf4218086acb7c5b619ed25d28f48cc466e3b6a9700dbf89aa84eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d6c463555a3d53c6cd4ba11ad09c794f

SHA1
265212bae3f91aafceeff6ed78f3bb24bc535990

SHA256
10a810524a5501467cbd4a235b04a0aa1bc8fee8630b72d2fa99a237e64dd9c9

SHA512
243f006d778e3616275bb972571ac4c04c3a899e7f438a41cae192e2947e93f70ce3dbd81c3479224831fdeb8f7d3a31e029b120f046fc1fe75548fcba24227d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
24KB

MD5
2d125f14bdd9b7d35e812c2a230a3cb2

SHA1
3626b78adc25829002f89f263d0f15bcd4e02008

SHA256
a94806d3195ecf25deb06c4c03976d11e4725417193a6235fd45b257a5606b10

SHA512
e5f992be3f3a1cb100da8e779f5cf70d23c141d6721b390901586cd0cb16c28cfac7a7f07be6f5528c1b88a79a28cb0b4765702c2190e2cc6d0fde9746cf7a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
46a34fdc4a81c2f34d94b3fe0fa9b846

SHA1
2fe26332b073ee3b476f8f1995fedab3098a9690

SHA256
1b0f2178453df1202f508f3df509ea07fd379a92e00e062261745ce46552fba3

SHA512
833e68f2387db19909e727aa96901b00a518d5ba75fc57d79b8efeed344f33c5bb1c7ef252f57d29103197a061cf7196f67e6c1cf52c0bf7f23c2b12a6fd1641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
497B

MD5
faf282e1abe118913dd30ac65ef41ec8

SHA1
aad6b29e1c7fac7f910e385229d8db913c61e644

SHA256
46e30af43e2cc981a4e432461c0a9f5786e6475fca5d9f3d7db029b6b5404308

SHA512
5fd9c369f3e9d0d5e20abe831c3fb9c45ae7a75dfbbd45d800e77671e34d49bc60ac28967cfa37d40beacdd43b5493e66a9e76312f7b3e19fa907eb0b27172f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
c9b4ba776ea91bffc85d643e0b08290a

SHA1
7a48ddced23c920ce6ccd1aef7214c03c48d0497

SHA256
e8dbebe118c0bd53f7a91a073fc4d20e131bee5b3460f5db212125a53f3e60d7

SHA512
7a496e6e6c628245ad1ee6deabccf00ec2455bc04f57165e2a97dc9924b0696fbbd31972ce570ddf4ded7fca23f1fab7d98d10823e901f4f50310e25a0fa02b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
809B

MD5
2583f9576ee73517914312a093632b2e

SHA1
fc751ed44ef50a0dc5283fd3087f66dc00bbc846

SHA256
b87d96268843a82ab781187b3756608568fff62036fb91fec46b90c6c1e8cb99

SHA512
a360c470ee07f3e459c9938ed0b5b095c515e950cef1d8d94d8daa5c7d63ce3b3162e4686e26d6f294fa8718901d67925beac81dce8405f35256b8b00851add2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
20KB

MD5
d43cb152e198f950b21bd818b93f5a01

SHA1
8e13ad9b6cda67e03adb41d062e715601d0d7ec5

SHA256
4a7a5e1e7ba3b2e7793d62caa1c03da273f9f6fd679c366471c03541124e87af

SHA512
e37b0aef63ab8b6bdd6f77ab17da00c49230e99a3376c98ffaf57a31a354228709f5329634d11f4330492c8d898bdff99a006faa373aac0d4b0c904aa483530a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
785a64932dab186a94298f15a1029439

SHA1
f1e108b7fad5df1ba7146839dbb3de7e1165f2ca

SHA256
7c49f5465ae05f6c0ccf65322ce33493de90ee75a19819f600b64563d7f3b98e

SHA512
84aa03210b26352618653d47cfb696fcf7ace1dedb0145dc2cab5b90fedb062a124a3063ca7e437877a919452c32f3994b3129e9f3628b4c51ffbd04da8edda8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aaceb8777ac082552e147d503fbe096f

SHA1
81f2c995e28708a9f6155075f2aaf5bf3d8783da

SHA256
40f0dc2fb1e3e56d8d9506b990b801030d42b0df166c19841f9cadb2fd505c74

SHA512
c64d0519cd3178d2e990395c36960b39b5b4504037609d2ce6950d2a4662fca00fe63594e6efe1c0677e249f1e20ef0495c63ffd71f31b8be11c2d1e648952bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ba8131a3a884721e555d20e80f33092

SHA1
b566ca3827c1011d67cef77426a83634d64d2186

SHA256
6bb9396461d6ffae7799f2abea20ebe3278de9d5ce2ab5795dec83005a0b6ba6

SHA512
bdf1e64501289e5bcd63e53a2a66a6f03c10cb90e363e53800f361e5ec40054a0c7deafe3cfe8c00b002f631acc6111c46fc9dc9cd1f4ef7aebded7bfc3574cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c0a75b708e9082c26b5be47b97a0676

SHA1
651abe784406134dc0934879356ae54a5ef1b994

SHA256
4da747e7f9d424f94ec5d3a6edc9d324ebb21dd27a2aff00fdf990abe90a3c99

SHA512
6bf7cb98e694484cb2b0da7e3526c058489ead219428698879f674fcadb1399eb8833ef6cca2f0189f3e0020b9f4b04e7750beb6943cd25da221a69b71d250d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
f57433ac947ac050a754917dc666f371

SHA1
1186bd58f0d494c7abf2314faff4c1b2734b4aac

SHA256
4af24c1ad2edd346a570dc410d885391a62124e64c64ca186a791e0804db8062

SHA512
f15419073f40cc89383d8f9df8a8c0c5f9316ea44b3c116c17a3b0ea692d72cbd9ee0b3c21790c8bc569456873c218c8a478ea9244f95004b5d1630ba29a61e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91961a4adb7a73bc23ff14df2f757c70

SHA1
bcd676f46e733f70c6eec49c77eb9b44efe1850c

SHA256
e0981e8d970b603e5dd85d68cde966a8a075e924d5857c7e26697b11831c203b

SHA512
752e73982bde87bbaf121dc382be841d1ec77c172324cdd5a5b3d274af4eb15995e7628ab917cb5b5eeed3220de139032d81d512562420ed3b347b4ce3a8f723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
698b323ac34a96063d6f4fe84326d91b

SHA1
550bbbafbf55e9c2309a45bc4151b774d0edb012

SHA256
36e66c65e4dbc2328459d5d83bff297efcd685cc9ea29e1241ab464be403e154

SHA512
5a36f48000385e6ea9da14c0ab6bcf2daa9cb215942fc966087227e135c4d61dfeaaa87850b6c380232bbac668f94faadfa2534f6916090d4547cd15fde911a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
cebf65ed49d6894e87443627355da74f

SHA1
8b64a5de87a45273fc6fad0946a40b5b9ab7c8f5

SHA256
4f94b35bfd957078d99feb19d71fd083b4c532f0cdf68e3fcbaca9f1ca54c242

SHA512
fbc0a09665ad0127f3b616e21c6bcf95ca1cb222bbadec5522cc22a8e4013bd754aa83b8ecf6c2e3221665d564ee5eca2f104bf23b62d28c2ef743cac17309ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13380488101433430

Filesize
2KB

MD5
95345dab2b322012374c4a4e8d131e5a

SHA1
33ae04c17d12ea411ef99d26479984b08df04790

SHA256
778c8d2ab23ec6a8667380ce6ce5733d5962c17f86079fdca96eee5e38422140

SHA512
e8aaee897a18abde3266467a318cd8dcbc2d80ed9605e91507147dd918bcf91942d505d1be8cac4f739c41f16738250427093c03964a39a29b1daf04a31603f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
7a2e60e69c9b07021349c90ff487b823

SHA1
956afaa4041b7cf7895f8257c0f08ca21a09ec6f

SHA256
625c5c198f40d44556f89e4dd0613bc59f0a8eb863a327d8ee370ed2ac13158d

SHA512
0d40ed379d869df6f0ae3b9832a67f7b9765924617a1f0d223d01a0af890687545d3bf50231b36c8b7e1dbed22808ba9023bbb2eb49749ef1a27aece1f4323ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
932b231f7000ac65dbf3329021cbaaf0

SHA1
5d9063548d0c27e530d25f052a445e59d184aaab

SHA256
36dfca19fdab4361a0bb5dde85df6a1df81b412e192aaf4937f10863c9bce642

SHA512
7cc3fdf0b40737d837992197dfde20d65fe360ea04914c31c888e02889c96fa40966dfb61cc1b7be9072ea8f05d16b98c446b3cc8710d3635d9e2efaae5ec22d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
b919c089a637bb84e21377f8ae325982

SHA1
59e1d7325c816b0ac7998a521e2570d1b6e88648

SHA256
8b7114f18705c7cf55568582c888f2ac49fc412eb1c518286017a397b72674df

SHA512
50af7ea37d89e6eea23355e3992f6ff776df0b31da8689ddc96e74c06bdb02ad6b9375212fa14432f1d8eb0732257bfc651deb3ec7690fe8ee53e1abab717979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
9c771c7699f96333dbf180f95e754505

SHA1
19a8fcd388d1b9d3e45a2dfc4f1d63d3925b1f27

SHA256
0306eb7ffe1747550eea10834b638dad855df718066c99ea0acd529b3c72e6af

SHA512
6e2b35b05d7b493a8bc67737577b90faf1953b21e9866e39841e852745a93eff5a8efe37d58b01129d5aced9b8a50c155abd7c167f42604d5660f83f0427a40d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
ba342376dea9d43fc970bc5aaa43656a

SHA1
7ed5b72fa5e8a7b40ad962e9128ae1a0f2401c8e

SHA256
aa11870d3fe40b721505c9d88a8856d7f4066c4faad3d78d162a9e6fb49fabf2

SHA512
cabee8c5562603c5f5cde990b230e8d35dcf3c5a861ac360200728e4aa90cbe43a8e8a16f612b9c2064e4e2aed7ee511f91db78b0bbe5b613e83230a5fd72e24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
24e5eb856989ce49f902427b85368c09

SHA1
42225c41fc37261b8a558480f5d8795ae661436d

SHA256
a4d7033257437a3dd4048cf8531dcda1a6576a81c2fd7085434ca0f924d9e334

SHA512
fd580181222f6753f55433fd18f02901766731642db3281f8f3749de63742bd1c71e0f25cb2167764742daaf1e0cdb56d91b70e713de56534eb4283c8fb56816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
5271be9b5f9006459d0e5ab947a9b89c

SHA1
8ef896125c02bcd0b93b75e679ae8b5aa5291948

SHA256
510953d2bcdf4250d1de0b724a295f32c4130ca0b3a7c2f580e2420bbc576427

SHA512
0dc760750de93749508d1fc1e24875142f1f50200facd5a39f73cc883324c96bb98695599c5560410fda68e10504a48586784604d88440682b69926dddfcec99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
7f8e80f4a77cc4ffbb50b468d02a2eac

SHA1
71e44e52d2343acce4b1e75c0a37bd582d8dff9a

SHA256
431747b204214591ad47bfe1ce37e0a2dc9dfb18a79a25dc65c2d1629df921c2

SHA512
2b8e5ab3d092f70e2bc84b5cd56d1ebacf374a16348d50f9f3ce25e5eaa4de0d7001a35066ac4b3bc71621972f1994c8de7a3bd2d10ee1970ebabf77285ed83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
6045f0a0595da8b07337cd259dcff6d8

SHA1
1cc8a8d749032b3c726658b3faf5efc1a9cf67c5

SHA256
80e432cd773c2d70e146282584edbc10a819bd28e75096962e6c35a11af7a2d9

SHA512
45a1da0f07996d0d54e5d9314f53ba6af74c8df1713483d2ed4adf49a6505e48bd12bac32803a0777a5e4b1f8f59857214822b24472bc8808c4434f5b8699003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
7a186aa749efd1a9b037c6f3c4608565

SHA1
dd1f2b0d2d37621ac43463fc988be532bd230c71

SHA256
350b7a7075f81c20ca8f91f47d2e9a094236694afc2d2cb40ecbd17799948d07

SHA512
638cfbfed8f276297d0a56f6afa405160b4ef503294ed1d8fc0c09b2a15fefa88ab855d4bfb94d99f3d308322b4cb220ba9585a30d3f422c5c3e5a00b8a911f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
31d0f6fc9706129cb7dd92708b7559c4

SHA1
65e2d5063e6c0eadda4681a44ab6dc43ed827b79

SHA256
376de5f240af53c754d895082618ed0eb40c36ac4f9d6dfa6378a2c3ee715a92

SHA512
da5624cf554566ffdc31a8b877de6e855b7520c7ec44cd0f270c6cd0c87ac64401f3b153a204a6a31069a386f2fcad405499c45f4d3a8192926d75c1eb08d1ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c980.TMP

Filesize
3KB

MD5
f948286e18b89f1fa0872a21a73296bd

SHA1
729c634bee4dfca9be2ccd9e94b88d11929c52a9

SHA256
072e40743715196a9716b2f041e378744046da8306aa0f52b8a2a2553b9b758e

SHA512
0f74c66cd295d0b03b754b8e570bf14784923f9b0b18e4e81b1f25738bfd4c5d9d1450f9defdca27e41c0ac5fa7c119f289c923ea86f9500fc98ba0bd92e8f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
e45dea8f5e1ef7edfbeee8818d59afa3

SHA1
597526627bf137db56705b487e04bec654d2da74

SHA256
a4d9c783b1511f0445771f7a4562437c6ede6dd7de31486b0f2d882bb456dcf6

SHA512
e138684e08b5536b6594cd281351108c3d5d2c4bd6267cfb86e2fcb45505a82d3887165ff08890d55408e1fef79b9dead8a1a50016ea8420f329bbb57b12c812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
eb3dd0e8a902880fd271d1632840ec53

SHA1
3ef8909fc8e21055914e676419923fd074c8a756

SHA256
97f6a398c67aa297a4f5d16135720c2caf93357644e2a4b86d2f4d9872e9a6e8

SHA512
1594d5a8c03bbd39678e9df23a83ea7744cf511980c05afdd5268e9a22589142a05e8e7726d3abae87fc508cd9eac652f2c5cfc36afe628ff8f4d9a6458b8254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
2KB

MD5
870d70f0b6f64b10db8181b2d79c5adb

SHA1
e006bf71e46702687eea93a16dab59ca4143708f

SHA256
a76ae9f1a44554e6b0dbaac00b6ba414169ce5e760c49f24529e478f6d7b11d6

SHA512
ef6167c1dfd19b035c940d5b9aad1e4de1219923c199e815277a512663b507c3ecbc7f417ed12283372982510f0d5287575698e2ef2304e33c8511461cc6a5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
1b131dd314244235a2591db58487e496

SHA1
7e7017091557a41dfc243486e4226f7200c5317a

SHA256
6f0976201df1e76d035c4976ad693d4f4b3c5fe91479517b2fcbdb99034b056f

SHA512
cc04bbe18500c7e908b3ac67d243e065a1ee346c16b30400af004646394f8ddb38acb9f6a039a665ce7b60abab77eb08e01dfb5c863cea7de71f123f10cc693d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
53809c5b10bc3702ddfcdb479402c551

SHA1
0a8435aa6b64218b3e57feb7a70ae2cd523af8fd

SHA256
95b37fc311a59780baf9846248e8ca70cc706fbc2c794be945f3895f1aabf2b8

SHA512
302a1fdff3371a2e2d77a0e9b524f2fd42356e83d6559c63ae40e9510eb693a6ac345639876e372943af28f04f2d644f84c64145611df360cfec6588f5d7942f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
819378fd8c1774ecd9756d8728d79e8f

SHA1
57069b3fce656efd80e1ae61f01aa73707f0e61c

SHA256
167dfa4099ce8c16ca1364e3f677389b91112fd14f0585c683e94c0020691ad6

SHA512
884c29374a3e3c35536ab4286fa0c5db3598f0be07f71bf824621d62c0030cd3c87ff78999a7cccb86069a88cdaa21216df8fb380668df17366fbaf7b7ea3dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
9e6745738a06b651f374bb036828b5e0

SHA1
5c72f04ce628702aa633d606969f60d22338b174

SHA256
ecb686a9b223f9391d28eb8a27f564e88a129de3c62f7de9ca97721868e0ec46

SHA512
46fb794e770a07e71e59ab46559f566ecdeb874c4349b98aa141db6b2fd18b8967b804d95155ca01d5fd0002094c09718d6f45bdb5635215ed0a519e09afd768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
e6dd295acf002c3062021bb20fdcf696

SHA1
de4937ae7bcf3613098d2a121dab1a12bc870f07

SHA256
efdb3692511fb2e8a9bf208c4e90dbeb3098457626d9fcac9ea504fe33e547eb

SHA512
76430018b3658bea7045158eecbe1d8772184a04e697d3d7c7d4fe69d05bd1ef9c68d91a36613bc89a46a1855d8d9975b89f16717dc3ec43ee6dcca909fe767e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
fd10e638b0e5adca31c73d4871a7cd22

SHA1
d2f8f46d4daaa2a4282979d4fbae4243a1db92a1

SHA256
8e78cf3310f34621ff13e5bb25aebd0824070cb0d15233b7cb5c3f7deb033829

SHA512
4f0fefc6acd1be42a222c621a91176416b534ab047ce0671992b57b4ea247031155841d76468af5dae302b00934caa4d59d79db5ba5d5e9060709743e7281ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
17KB

MD5
111397b8f86fb6e02df2d8615006125b

SHA1
c5696bf9eacb4bc578252246fb5cbe043cc0b4ec

SHA256
e37baabaa4f9f0562b980bdb8b383fa24e58fa90774363374144a30401fd5919

SHA512
17c736cb6e17c77d6fa4187c33bd7b4eec313a77b187914427366425004e87f9476d7df7b5ecb2a3166d5ef33d0e84600cc840a350a99d40bb09c09f065a8e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
26KB

MD5
ad2134ff16b8955dbcf63336d3e33d58

SHA1
1d818cc140127deca1fb5bbc4ff88fa3ff52d6df

SHA256
b0ac89e9f894fe05628c1bdead63741499df44688ccd44351d58feab09712246

SHA512
d540504b8e393cbe5438849dff802fad000227e114a4b2e155d39fe082683413c3b14b493ac0bd0e6bccf40b9a15a86b508aa76ca58a24a1a2e426b67030f09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003

Filesize
22KB

MD5
96ce1475604d86c7d8fc607234dcb846

SHA1
9cb11503e2abe76411cfa8db1082ddffd16fd2f0

SHA256
16c483d7d3b55a7c4bb2e87ea8fd51c32f275a49df7ecce0d74ce46f1b952912

SHA512
a64c81cefb4a1399c6cb58fae393c0755eca4ccb3c62fe1abb68159cb76162b1836d9c0c337fd30176d16f68a3aa3696e21a03c7710cfd1158e53782517b0b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000004

Filesize
22KB

MD5
5d600274116ae1e03033b032fe49e3e1

SHA1
577288fcbdf7e91a5d0ad3a658fabf0a01f46b09

SHA256
5482aae4d9922e1cecfec50abaac2ae2aa8b480e9aa1b2d82e93ce8e919ab5de

SHA512
eacd8be3a7900ab4bd7524fe76875cb4059fc3f180a2085a7d2820a80c4ada63a03c8b53097e4180ee1a1719ae53b2ec0ebff226c1e0ec5aa71a1b39c5ab7270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000005

Filesize
20KB

MD5
d713ba9b8bc6a09281e1c2166405e4fa

SHA1
da30fc10f5f79c7504081778243123394717159a

SHA256
4d0624fc5f612d174fb0fc97eeee9ce54e75f21606244733cd6bd92bb9f045d4

SHA512
4ad4ef2739e1f19c9d23b90d367c7185a65cb3ebd8e716297bb21c8d82352eb15eab2dd969a743db37b0316c680227e50c0fc4a96d814b856c73cab5d9f78dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000006

Filesize
20KB

MD5
2ec494e3841e8ead0d3921f298e1506b

SHA1
ba8d046f7923547a365dad8e77f6ad59406a35b7

SHA256
a327edaa945e3091546f39ebf0458d1fef0d60ea1221fc0ee291a7b2fa8fe426

SHA512
177445ed9255f01de7fe3fd7f32b621f1b4d687032033199881946f6f7bdb3440eb60124d44a7b43be5ec42c9e162e4b0c0815e8db33da5e444a9081962e3281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000008

Filesize
26KB

MD5
8235f98068f731038d8520df4727c625

SHA1
6ef1e3ca36d59de490e593ec195b632e8e09565d

SHA256
98280dcf81e7ed7a29b2d383c12027481bf771aa6358012ee5ffcc8b3af21e38

SHA512
d75d4b688898ee9c9ee07f7be6e9dafd0154518ac54042270666969dd15dbc3b7c8cf92997c510f42f20a5ad8270d5324dd8f2ef91666a9d6d0450d60bacfd83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_00000a

Filesize
24KB

MD5
c7420dcacec18c032724b743976447c0

SHA1
8a50a86debb05656ca19422e8326c6449e3d345b

SHA256
3c813b73398be7c6d1b7a1fc311e1fdba89086cb2b535f75e2b99a83a394e780

SHA512
d743872802b7e43acf23f6717d2705274a43fbc9d4e57be8e68ba2edbe7bb3d2b8dd4f2545004ec388bbbea3112c622176f426ee0289f344c723b12c3e715cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_00000b

Filesize
19KB

MD5
ac8a5d1edd8cbc5becf698797911cd1b

SHA1
03e1114f4e992f9f42296d8a61205116d26d08ae

SHA256
6b0d53c56c634f65f371f8ea7b4035ee17831bb7a396cbbfd828600239bc0aa8

SHA512
b28c2daadad1661443784b07c2eecd818deb1b1daf1f818d8dfc37bb4dd13f7f15b92631ae98e48229d7ac2841ce62bc931d60857c20131d7bc55203135d0471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8c23104fa3ab82bcc47b90ef032d53e

SHA1
e114942426efd4df0f5a43661a6845e9269f6fc1

SHA256
7eb9f2ddb0a8f748d77d76dfbd958713d85a44072b3d8c6a5ae3892d032beec2

SHA512
a6c4b4759c2e139f3527655e85e84700f3d0128c175d08154b14fe1704fd7a603bda94e1113fa03265ce9f69d572c208642d2e0cdc6f4a73573dd88fc93229a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ae357e5ee188abf5896800ad1fda74a3

SHA1
17d7af50875ea10796e3d05d4929b184e1c39e43

SHA256
78ecc18111946179a037e2c470ea98c0aa20071af5a80f7efc217ecafa6e1f8b

SHA512
b8f744b30c42d1444ec5a35029175fed1fea6f25e2c6488199f1f260c4d55d635f6a0e8157eae219ebf24c6a0b7a5f476878ce8c62bf65e44cbc3d1b9e1f1e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
681638d02224a2ca9c5b7f32c462b43f

SHA1
1100132e20d13c9c93de8ad1ebc6641cea22ae70

SHA256
f1251ee8e29adce880c14dfea6259feaa1ffe2ba37f5c490f2b319ab19137f82

SHA512
890f4b5f6511fe354ebd84297561ae633d9594d4abf8cd530ff662e15c667d4b3fd1f223cbd857a5f747a7d9963a88457aae9343803c65b373b1b3d02cf09d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
137a2e56e5a1422b378ec29d939c662c

SHA1
47cee4b9150c8789e04afc4a51b81e5e74531683

SHA256
4b26be914fdcfaad2a274128814c8ebbd618aee465dd12e88735950a64f9442f

SHA512
6b1b9b6387f14b3e8d3b17c7109cac97cf4d96459e747a9cdbdd56b00518f835d9e2c88d617bb441f0d2eab04f337de8fc39c8d80ba7a471a98aab9bc95b47c9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\AlternateServices.bin

Filesize
8KB

MD5
bbb0fca7c01d6ec6278f8a6341ecb213

SHA1
1048746c32580cac3c6597261b43ca7b35e6453c

SHA256
eab5ffec454524284f253ddc7dde7fda44523aaf255f9d878bb916bdb317132d

SHA512
7a6306985110d02b222932adaea169178f349f5dc5fb71025ae2e32891fde6547ee8510532dd52eac0172f064aed04db9147678545982f312fb8987f68218454

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
d099490129d4eff0c4f9bd718828e4ab

SHA1
52aada860061985749642566e5c3d9d2ade0754d

SHA256
07056a610a9fd90a644041fb190e2af5464f29412c751071820bb5169e9e6b96

SHA512
0f161ca3580c0e0ecb859ee31ac9b777562e29d3727aa4c789020f955c72a2165f394e9a4463a66bc3b37f330a843e2076ca4d61d0f347154bd020e124449e37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ca5a1c639b70f34f18eb510ea117567b

SHA1
7bed06e12d7af7dccced8ed88585223ca124e747

SHA256
7b9a87ef0be3f4eab449580f0443301f83fb60616a47545b64420fef0e139cdf

SHA512
c348556d218e85a3a9443c500cbeae9b12bea2882e097ff48ba5828dd79178a167011a55749de0f76e37c03726d79eedf7c214624984739456e1d81ca1f35ec2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\9f7c84ba-7bcf-4427-8d6e-55f99ce0bd24

Filesize
671B

MD5
b03e1f0f47e24b53922dd670aa98ef46

SHA1
ae53826e48ad06b10a140882a721d781eda18d02

SHA256
60c63d0c3548dbcf127df915b924a9a5bde4e9f102254ec60039b6808e3b5284

SHA512
ca1f36c919702e2c51050ba9f3fa54430e22456c9d6f9cdf6ffea34a0e5fd5fb25be9bddf95a8347687249bed9532dad108fe80798404ee1572c7debf4ed4573

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\c2c7a6bc-bae4-4aeb-ba3a-13abe53b5444

Filesize
982B

MD5
926f334a3f91fc03b63e882313a41a42

SHA1
0f004d43c20d02ea679a8058f5b3efe81194dca7

SHA256
90af73cb13efafb235b991916630e46fb62916684ee540365ba00c7257841a1f

SHA512
ae4d3210dfe5f32a22950a30f4857d35266c081aaa7b8d0c7cf97cb76d72aa5dd8727a887e1401e97aef3935ae7fcb750636b04ce2986c8a1fdf12eb765746e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\fb5b8953-b0db-4490-8115-9885aa1be066

Filesize
26KB

MD5
8ac4a6dd3e989dff77721d1b7a69fd8d

SHA1
80ac85d9495dc8188d15e22de4d5f7c933d0338b

SHA256
646c9d1db2de174b1faeeb1f9e51a017fc81b5fa597d24162e0b7cb4204abbeb

SHA512
b18e5090f5020b74a15b0958c1753142d4d941d4c1ce89d3525c0dd6f7700eb8424d159d190840331e31062b22e142574b3b821ee1e5206ae69fa062e622c424

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs-1.js

Filesize
10KB

MD5
d9aab0df3952cb6216ee629966e1a68a

SHA1
182e1297bc8559ec1b53c29774201cbc04fc3240

SHA256
7d2830fc39aca20de5cd6fc5be65f9a48a8e99693e9cd69645c0ee5ace16df2a

SHA512
0e4b04d1baf4600a5d42ec1d4476ee72ea981a80b5b99afbcc897a9e125b4d79989f3c432502e7e0c4188d57451dd30fa770734aa2475d0d03d8a9366d3276a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
6b77a9f779399e95d1cee931a2c8f8ff

SHA1
826efd4feb0d50fcce5696111af7c811b81adcd9

SHA256
3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3

SHA512
ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
9fc8f756e7109adfcefee2f252c8300b

SHA1
88f20402cb6802b94589612c110a2993862e7483

SHA256
567b38083f0484e12bb49e9c083f8d2f325ff1636ad6c387f002b0508a8b7100

SHA512
c2ac8a2bc4e3d2cb35ad22336e3dfb04f136d4491e532a78cbbdb6f9e0331c88031f4be1e8e307c2cfddd7aaca7ea59adde777d39bd8ab4915a5abb8c0bb3092

Download Submit
C:\Users\Admin\Downloads\Loader.zip

Filesize
5.5MB

MD5
15988ddd4ef8523823cb8670ec3c9fe8

SHA1
70509c9287dd990ab039c883a9b21ec76975aec7

SHA256
0234a78acc9fd066d5e8ecc660497e92b88c8ccdb4f30527b992a56a8132a781

SHA512
d815dd3da903409d9bfad9048af67c3d8595ea04a9d9ab79d41b741bd70f13f75854e5e732e3dd9457a9ad694f6b55618bd8daf7bc295e4bab5b48c74cdf309e

Download Submit
C:\Users\Admin\Downloads\Loader.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit