xworm | hxxps://mega[.]nz/file/tQdQXbza#T7Jg7V3gnGr8ENM3MNpCT0oC9Ls7KA48LfudZLbYwGY

Analysis

max time kernel
210s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2025 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/tQdQXbza#T7Jg7V3gnGr8ENM3MNpCT0oC9Ls7KA48LfudZLbYwGY

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%
install_file
microsoft.exe
pastebin_url
https://pastebin.com/raw/N6pAtM1g
telegram
https://api.telegram.org/bot8194509243:AAHuGycCOOCR1qZuZsQobJEKrfnKQFVeryI/sendMessage?chat_id=6570700929

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023d46-289.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
123	pastebin.com
126	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6064	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
604	msedge.exe
604	msedge.exe
3808	msedge.exe
3808	msedge.exe
1364	identity_helper.exe
1364	identity_helper.exe
1572	msedge.exe
1572	msedge.exe
5520	msedge.exe
5520	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5520	msedge.exe
6104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	2176	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2176	AUDIODG.EXE
Token: SeRestorePrivilege	1776	7zG.exe
Token: 35	1776	7zG.exe
Token: SeSecurityPrivilege	1776	7zG.exe
Token: SeSecurityPrivilege	1776	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
1776	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5520	msedge.exe
6104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4596	3808	msedge.exe	82
PID 3808 wrote to memory of 4596	3808	msedge.exe	82
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 624	3808	msedge.exe	83
PID 3808 wrote to memory of 604	3808	msedge.exe	84
PID 3808 wrote to memory of 604	3808	msedge.exe	84
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85
PID 3808 wrote to memory of 2392	3808	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/file/tQdQXbza#T7Jg7V3gnGr8ENM3MNpCT0oC9Ls7KA48LfudZLbYwGY
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ec646f8,0x7ffd8ec64708,0x7ffd8ec64718
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=180 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=904 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8708 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8704 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8560 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8808 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8692 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8340 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8688 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8340 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8612 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17010306114418214632,4245784554885658926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1876

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\FIVEM Spoofer v2.0.1\" -spe -an -ai#7zMap4856:102:7zEvent21203
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1776

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\expoosed.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
22KB

MD5
47edefe61b20751d8a4627be8bc0497a

SHA1
eea6ffd2e1f1b6e87fbbab83f5b2fd5cc81b79ba

SHA256
6bcaa27876393730459362c0f92a79075ee80c40d33d6353eca96aa63f5ebfef

SHA512
f011bed709b4be284a21ffbb4f9e294aa394492176d06c5d1cd95a67e9e43e88dc35382148dce01814a73cf295af54ddc647dde2d566f2aad675a4a4e8fb2cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
23KB

MD5
e569b5f6f14852ff50ff8b6020799f68

SHA1
17cdeb1d710c8011cfe932c31bfe0913373f39ff

SHA256
9ffec84a0d845309dd4c4b19fc797375f97ecf0773729cd12c7eaafae877e384

SHA512
2a41d1f2af7c1fd30e9370f37d1807bece58d11d3e33b9325e13062f9a3bc3b73ff47729a0a09936d40fc91f8af09f37447a20cffb3ff4b144eb7b42f63cd820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
104KB

MD5
807215c2aca52b7973c1ef6bb2893490

SHA1
f288cb1e63b20ae605a915df1da69881fb6203f9

SHA256
f83a1dadb97e84b7789fb995e42770a6f71d305764c8c2c62936ef197ddc585f

SHA512
3f2bfcc8ce09758d9996110bb3b2a91bc6fd70a70e062251dc3673d72abc39df6c8f4e0fd42226408db6553a782e74e9ffe2daf54b5694cec8f38eb9fe34aaeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
179KB

MD5
4bf2a583da9991829b201d78c28beab8

SHA1
62d4244f4e36aecfd49095f3167eac03edfcd779

SHA256
1700d194df0d2381bdfef21d528c139563133462a358a5532acc872ce80695b1

SHA512
cbb57901d78e1d47b569bcacc3bcbfe2b49c6475b9f8559b2dfbea9a8875e7c9b44399ba56714a66936587060e520bebc1dafecbe0cb643578897e02d0cc4948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
17KB

MD5
ef376189e0dde65ddaa0ea7c28621d52

SHA1
8776ffd60532b2b3172bfe6d084c5429f28b0e3d

SHA256
0fb06e9e3d1fafb1fc68d9e7988d637a6425042c9100d39991a8a81ec0fba4e3

SHA512
1cf47b0ace5e05e2f62062470983ebd23ed2f4a098adf75d86026fa4c4716dc288b193daeefcc156f6101bd6153538e1d67e525b31198e5360f4ef79d0667e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
25KB

MD5
7d4ff0a2846bd1160893c7499cb74d15

SHA1
d14ec459d858354764d488814a96e884d09dc6ee

SHA256
3debd82aaedcfe91bc1ddecfd0921843aaa4890182bdabcbede903f46dab9aa3

SHA512
f9679525f4c9815dc9b30d9018d32beb85be08c8b9e4cb2a428ab3e89f199a4cfa48bf33f5e435a336d3f74ef6e411ae2702de2d7d5c3aad76ca305e48e2cad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
34KB

MD5
f39bd91cb2314f8e51393174a7c1afc5

SHA1
02d762479c38294507ab7961134833994b189e28

SHA256
b75250b5208650dc0ec42a6b695f77fc9f0e8c0ddb2d9a4ad1a4da7982b1e235

SHA512
68631fccce33be683447101d3416d87fdbf9efa40630fbfd85a1e0865445d0be4aed18665063b44320402717a2734b25b6f41110a25becbba0e2c87f453906f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
207KB

MD5
e793558eec518cd60109deb33bf84f34

SHA1
27c81f8e49315863852bdd1522df83ccc300b599

SHA256
8fd991b4e918167fad29da6460c587f11045de95577ffe66d69db9077d656912

SHA512
d176a2458d067cc777dc45ae160a528e1bd12a97095af64b642bccb0e41316b34ed8eb90a1b8d89d51504ea56651b1965eb89e067eb1859649c71d130b0bdbbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
134KB

MD5
276adf79506eb02732344e93c1f8befd

SHA1
261c48346427a5a9de4d3d22a76ec9b817516fdf

SHA256
8e4b7306c34d6afe088c5c422a3ca171b7e37915ec0e8654bd8b4b63b168fa55

SHA512
ee7b3f2f8c040dd5f644cb0bb304f65493235e4fdc387ddab7343583ca2b7a694b16fc588a887d17924eb230434a6964a3e04966774a4b431b04e0814438cf17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
45KB

MD5
2bbe412fad146096d0aced4342b42c23

SHA1
de5ab613b4daccf1ab7b4497c38b3725128518a7

SHA256
e73ceb1a47d2d4b53ed40210919b64fe0cdfbd05437fa3b4762a5170b35c2820

SHA512
1463b7c8acfff7cd154a53871a2ec34c0e8dfc4e93df6d63ec9b34385cc663f410c8bf13b366f58b87073f90719dbf98070e887213c5f3641d5ecbe09e59e767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
155KB

MD5
b74f4cb813f220bd09b6b5135c6f0c51

SHA1
efa7a95f97b0c38f400d429ad0316592af9ec964

SHA256
c43ead694533f49b58beca878f3f63a66218d73d20e438b00181d777f8718824

SHA512
02ab093546c152085788f5e4e9424224d78e249dbe65f2161c91652bd6a97f355a4e7813528cd9b03ef129b12ccb37312504fbfe7c19d378d689c74f58719b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
86KB

MD5
c630f465e19f76296c1501b929600743

SHA1
04c78a32887db78cff5b81a8720019170b1a57fb

SHA256
a8fd100ea6212d2138e5b168420aea82668f3bd9b92bc1b4be0db22a51d515c7

SHA512
24d4d22e3ab8f5b612e16d0108249f0c9e3067763ccb21761d913b35d6520b1e14f757011d8107aefcccefd1332602cffa2dad25c82e88049f35ba6f9c861b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
76KB

MD5
3c335f599093a507a69275a381830f95

SHA1
1cc8ba9cedb4c21bb4df6c3409fe4fd3d960a57a

SHA256
ae7079947cc70e9851e79a5c0755da41116541a4043ca2cadcd2d84d692cedc1

SHA512
76e8fad2acfaeff70dd22960ed6a2d1440997240b7b975d3da04a2ba7f1185e092c969e397b81dba0e82fcb88df8f5f6edbb745a25ba436294d7bde62faeecaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
32KB

MD5
15639b7427cd853d953a63659e7139ca

SHA1
4700cb9cd68a43fbd59972390eec62b49f139848

SHA256
2692be8d456e476930224ed56f09029a903a52c88f1f17f58725b93351a71b55

SHA512
510e5d2bdd9beb0104e5005f2c0712c292ed76986e0cfec60f0e1d57fd2fb8cdf175ec8572c93722dfeb9fbe8efeaf0d2eaa2030c2b72351156e834aa65114d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
67KB

MD5
a3891bb218bfcf34121ffa132cb4ccd4

SHA1
2ea05955e7e96d010f984f742c4d03625b900f4b

SHA256
cf8c4657cf7844bf72e3219f170bd58553cc6a80c0f9a13487e4dab632f5917e

SHA512
997dd4ce388b5e07006338822249c778d06e8d3e1874cf5b38568ee1d7e195680d6ebe8ed540956d89304c2f08223173edb59fc144136128c95d1e8b9406f41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
18KB

MD5
1c65922c2df6f4844852390d5e22e5e3

SHA1
3d42bb20f20dc0d14e0751fa2b32ce3b20e8ae35

SHA256
d5dcce04b2e8e5ce64887c1f4057878c6edf54269f79b39bf248fcac0b2299b1

SHA512
4db897487af920dea686d25b8ffa95ffe0f2b41ae2bd2fa6ed9b8a8e1f58c655a8791b53e5b1baad92051eb4934800fe542b51377dbaa3d7d911eb6698b04f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
97KB

MD5
b6c0d6f94dc0edb235da9e00ffaaba31

SHA1
a7a3e5eb7ea7ce49a6eab215f22f87bc18689fbc

SHA256
ce3e58499928b15e01579b199027ed6c89093fb3afb1ce6cf9c8ab561bdd6883

SHA512
33d8879ff929eb70775927058bd40fbb797dce9e77781e973bffedff5da783c31bdfe2465d8039fca17057f5436ff9b384d6b957565f6bdfd4761150bc6a361b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
27KB

MD5
743438659d31b895fc9cf7c69a7832c0

SHA1
452d607d73e5643df11e522344f36b253d5de8a1

SHA256
c0b509b9923c00a730ea44bc839574fb609e771fe18724935a463f769071eea9

SHA512
11a1cfea0521b670e370787d153bb5eeaf17b7cbe112a5a55b3cc2e41fe575f0711e306f73b11be41b184e3f459e1404deb956903daabf33597d1550e0f7d079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
63KB

MD5
e3ac2a81de5485acd9e4c1768dc07b88

SHA1
2da528e47c6956b94e5716ca31304f0b4dd6665d

SHA256
d44ca9ccbc140e1848e3656e96e1f89fcc2da5a1fe967757f27f8a9878e95320

SHA512
8b6c8f12423d841ecc4766c93ccb7c2c9bdc00a4a2ef0c63461975821e6aeeebcbd3ecdaaef44249b67421279dddabe2ad6b9b80023cf686e3ad911037737d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
20KB

MD5
bc9b04cd87d3223d73540dd3db0478fa

SHA1
9678ea03e663a2d751f83d33c964774af42cbbe1

SHA256
29f3cc09f4346ea6d9db0106f5c3c3f7758471c35a2ac581c81219502c12513f

SHA512
b2b975d3d41209fb5c879cde22936a86ba81551dea3e943a4d7dfe9110e5ce012ca2b54e0a3749014bc141bf01b84e74e8b0be575979afb3ec294434bcdcc691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
34KB

MD5
cd28431242d66b4fc00615b887ac5805

SHA1
4c03d0ce1ddbd9e7e43be1a56149d0dbd0437ffc

SHA256
8eefb6c2900b6184c43c6844c1abcb416131953406d7e3077676b7c8a86009d6

SHA512
f59f4771144e39902a5af5aaad84865e2c946d1fe7d617190775ef136e8b9045ea1bc8754c78597e1809b75f74b6e7dd0f886299825aa80644bc6b7c7ffa3e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\21e6f9145ee1d3e4_0

Filesize
257B

MD5
ebdb7c5107fa116f42bed65b0e054ea0

SHA1
3206e24a02d4d19a33d6ae960e26eee7d9f872b9

SHA256
e6d126604b24cc646e9ee8b146af132c916316faff718cb4f9ae5d2ab3657cef

SHA512
4233f600f16129c6ff1434ad9fb53d6a21f627156240ec62eb717518038f07e4206209653b2bcd73a5267fa498821a563f1d529bc5a3a8f6de0a0dad0bddd40f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\301153b9454f0808_0

Filesize
141KB

MD5
8b038f80197e711aa6c9233a095cbaa6

SHA1
c9a8d8a0b7cd2d73680137a509565b3bf123bdf4

SHA256
0ca9df3331c48bf63cf3a2c2624c9d9f19b79f829c235d811235b3263be84475

SHA512
e7e3ca0eb29c1ff458dca74975b1645103dd55ab64951b4ad03ebfd72e8613d79b1899d2cd5398daefe37ef0e1dc88f2dd8b8ff196eb11c624abb0c3dccdae1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\404bc78a28d258d2_0

Filesize
135KB

MD5
bcf09f4b5be68264a43e2e9844209bce

SHA1
facf2ae4e25828a8cd9681c1db7d88fb8ee6fe7a

SHA256
fd876c19fda8050ac82641e7a3331baa2abbe6056e73d9b01ae0bb607b105462

SHA512
029569a1adb4984a19b9799726828ff1345b8ae73b60108a61578c4600bbb463ed4e9b424c923abe66557121c6f4e1a46a5974fd7185cd8ef5cf8a4e96b972b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4147f78d6c2e0d99_0

Filesize
244B

MD5
6e046f43e7099179541f496d39958abd

SHA1
363682e74b4bd28ea0a9ab1945cb4d0c2cad985e

SHA256
0bea46c2c5678dbb2448ad4a420cb9dc0ba59048f92ed44a19450e75d97b4efd

SHA512
3abdb7a33cb92958d8490b97830ab0ad15420dffca5a3367e2477cefd9a2347bdecea754f944f547d608e48cddb8deab7d0d00f522418630130331e66afb3682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6fbdc2cc2e9918fa_0

Filesize
77KB

MD5
0de1f1021167aaf58095bc67393ec85e

SHA1
b76b2b059639216da5c8eddf42e2743360d04083

SHA256
acec15411fd4f17a8b3e5661a069b6df94e0d059e737e1a323872e9f1527af98

SHA512
90b3b1fb89b1373aee85cafb30df9df1c13b08d06b08c68f4dd4651087eea16e9a28b188a9e52ccc4af01198f8a8dd78b11eaad4c9f51def2791e2a77f9e50cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73f61f9817732625_0

Filesize
26KB

MD5
db8363b725ef71cd78e70caa2a09fd90

SHA1
96ee320424bdad81694eaeb91c35311751d0edea

SHA256
93b7b1780f95e4c7767d8a5dd6cdca4ed32e6487b03dda5836c2c7746dec73ba

SHA512
24f136c145f05ef72cc10dc52497e072a87b6ffda8847ac91989e1f36ef15ff34030382d28d9eb220315c8a3f22fd26f2be2f09eb442465f3cf703dff26018e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8223149e4207bb88_0

Filesize
256KB

MD5
a306990ac7fb96e02e2fd40aed0e2855

SHA1
ea3f1f25b3a2d1026cd26e598555d3d1a2c5eacf

SHA256
66fd099112c5c8542c8e38d7bcbbe3903a9b4231ced87cde17d9511294294885

SHA512
f9d8e39312c62fdf097bcd6ccfbcbb005b2d81c144a458ceaef4fc5ec2a44f0f1edd941b896732e6de6722edde3a131dd165aeaff5f6cb3f7f841e8cd2707c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\85ddf220ffac00f1_0

Filesize
241B

MD5
7c31427a1f0ad6d7991998864764100c

SHA1
068faebf3de21fc941801f1dc8b865db4d73ab09

SHA256
a2ffb10600e3bcaa57891a751972a8122345bb7416d10741109e74bb3716b236

SHA512
b2c4c2b1e6f24b9356f9de681feb74b554a203de372cff0b4bd1979496b87bb7b7214e3dbdbe041bdcfc50525dbada4c20f99d147fdd35626f9372708090898d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ba8e3dce585e028c_0

Filesize
250B

MD5
19d90f2dc6d4b7c52b2fff6b75752edf

SHA1
b58a3a4b1559c023f54d8c19e3e78ffb3748bc6a

SHA256
6377f79e1414725bcbfb67dc59c7a201225aad91e1f68315fcbb6fc5d769657d

SHA512
84f86b59778091cc1f7bba25fc0a42b3c2e7c8dcb9a6c4a032b4aaa1e757b034d109dbce1dab47ae49efe95073e76fbde7f5250458002251bd1fc951f8f206d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4ce53510ab1915095a25e9c6369a5f4a

SHA1
12f38432e447c27da525c6400726167f8ee5fcee

SHA256
0b858470fcd6b2f12aab3713b0c5929561a3e3ef9d6fbaedb1e58b606f0addbf

SHA512
fa08cdec34ba63f25c95e39f237eefd48324d223add987885376731ee58f2c20b2148ee669939f420a3c9daf200aa258f0811f646f3b57de0b0495a8c0c1c797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7db8c6fb52843dafc776fe398ecef3c1

SHA1
430af2902e03027f3b60564656c965669881ecaa

SHA256
aaf071d20da82d3bfbfbb9ca4d6f8d00594f02c525e3ec8e37562f1b754532a8

SHA512
21d5e3885e639501af37bae7581b31f5284e24f54252f8898feb437c362d2c30fb0f9d188181b0400018ac1d66dd1f4bfe7acef3bde4ffde6d4b3e8f6f29bf2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
735280ad97fadcae5140ddf89030b298

SHA1
9afe369d4264465e28ed56a5e578ec3e2220c9f0

SHA256
8f7003a2b18c0ec69cac6c8d4511fef0f1a902dbadcdc6bdae4b75db1b0a8805

SHA512
07f8f1ccae639458988a7ee56b17aa28405511f098b18d361c1b667fb0d83d8c69a8523006d62605ba835b2fc23f13d8bf6c6bce101a71189a8f517fa7ec5e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
dd23b18ed68df93558f698ed62fdc662

SHA1
95a6db275474a07271b49264abec582059514dd3

SHA256
ca7ec977620ac90c1d9c08d568a2374b6444e38da482bde1e457ac8b8b1778b5

SHA512
09ceef2491b708d7a9b20f190a2b175662c305deb2ba73d3c770be54057de6636c2b91e6bfbece8db10c443ee3c5c1a9422b72dd71f99bed0160652c5ddb4b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
836db9eef9694036205b218185916351

SHA1
da7b6517c00d930ed2743b9d44a27b982b8b7338

SHA256
b6df67f1091243581e9b6938e36eda665b12131d7398c0539862c4746f495d99

SHA512
f2c04c8cd808cc1b60d26d6e7c27f7f8a4d4592ce1bd8e4bc52453a96796f198658916748cc9113c46b9df0ffe050bc53f6e47c7592322a8ce7098f92d1941c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
df2ac37aa6a136845b6c867dd24644f6

SHA1
dcff32380601f64235e94f38ea2251c1f14de8a8

SHA256
ed4e702f1bd4310175e2a8e2f3b01a876f2d53199832d659e31f0b83e3356f37

SHA512
4f3969acc4bf4dd7da73694c6de36c3cafad3bd45fa1f10380f4b92de001c92812579b1febf423b463d3b6a05254a4d9b679db2ae17fe8ec7943117cae42e369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
dfc263ca9906b11ac086ae20ed0ba2df

SHA1
da92205e6d27631910e79e391c81d6737e05b83e

SHA256
3c4105c3c4cb69f835e92a08c9c64e8c7d6d03f7c376e4066c258cd3488c07d3

SHA512
636ae21d696dd9f9ef045af2eadd4e6279f5870fc640ecdb6e4560f785bbddfdff82f4259e7f9116cd3ce4a6cfbef05c33bb14e225e9924c2b1bc4e452f67ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5c7a8793468c70ed80a2d26a8a6be23

SHA1
40d8d81482f5f7e1358429f1e2d51315c1679b8f

SHA256
7e997448fccb938167238d6a40643c42b0e5018f3fb157fa6747675b00033c5e

SHA512
9fc41db805a1d3eea3a54a8c217527c46532a172871ac1fb8454a3a2cc6b36ca06604e89ae93eafbd830fad2f306e956d526d4891c841d58884f0ccf82258d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a13b2d049e89a04281943b364dd71c3

SHA1
c9ba41c3250d99b3ee6e6be52ae905a360d73758

SHA256
fd8185aeb43d7e43e6f834885da372087d3b1c6696a3166fe2232031fa5437df

SHA512
13ae1270c3528a46ed24193bec317c67ce2a1160984c33448b62b3a41863e2df92d9ac41e4c0f6d43bd09ce0707068b026748c2fb41475d948b3ea6812e9f66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
be15aade880eef12c3687f63e7447341

SHA1
52acc1db49d539c55a21bde896a7a3483979f30c

SHA256
a761469e12b91050df21d0ccfed862b77f923d8e09e2348318979d13e8014bbc

SHA512
7357ef85779a1fa0534419a3609de44c2a383d85abb4f98d6f10466e071fc475c57b13a3ff266d9c9278453def616d0719cebe78ff5338f01269acd493802e5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e213f2e0c63e192a6e96b6008e3cb007

SHA1
5c8b9c46b3a5ec5492d52172cba5c61cdc356fd0

SHA256
26132e843a78629ef69dc13fb4d17914565a1a54fc2cb06a67cc45134028b42a

SHA512
7fabc05887939e83fc63e0234f4552f84dc17eb952d06e461e591f1c97cac261bab314efcc74622403f2803f3cba78301515c57c0adc7fdacb3d11f0cc777185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
8fb108e6f92d174ab019bca31ea0bf24

SHA1
c0dcba642c1c95865296ec878882659f28b93028

SHA256
addf69937cef969909d3959fd98d58fbfd41b8d43b21eed230761c2d04420dad

SHA512
c7ecc58a4512858005372799f6f70a9cc1f2c5845f565044e184233a05bccb78279320360f208508ae77d55c7c27171b55824f322ecc0c0907a814da62be1460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
a029ad1ccfc6d2fec2989ec983bd22ea

SHA1
87b028546c0316376d68a197ee33c51f6bad3270

SHA256
c0c5968b328b326d8c533fc282de619f8e9d0b156121f42d30a031b180cdacc4

SHA512
716b73dbc5ef2e16d805df8c3073e7ce3a66a7ef57c4feb04429e65f343823d4d9d068c00726b14aebd545f5faa58486e1c1cac69cec200fd7f3c92e97cd6433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f9c16fd4dec552559309a5a2499c67b8

SHA1
003a2d19a771eaf505b3f4bf55b41680433bf9d0

SHA256
e7651fb31ae0ad6123292d06954a5cefb33502db7b5699eb25e3f1058226b6a6

SHA512
e899570a266ec09bfd01ea41b337b32a47a8a378f66f429e4ac4d5e1e359e7e4a20d4cddcb5bed942f9b0a643c2f72bcf28fa2ec8571464787732cff4096a561

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
2646beaab35f8545239ec403b73b225d

SHA1
933567b39f86d11f23b0052aa1b132f6627f10e3

SHA256
8742ade80b35a9114d619e0ca02d7439009becb8a5b0c183402cee5918a2e738

SHA512
9e96b384722a699e84d8fed2edae10fdd72a51bf5d92e1c822bf52e51a3bdb3060610c8098cb5c83e7048b958cfc2b7c6b8b96aff3eb7adab692bb0843ddb9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
87fedce31be0fa7c3031521e786a3cde

SHA1
12fddba1191af305632ae21d313d2da7c8bd939f

SHA256
2928cf1fbf3d78c09ec5815fe3a2ab172e7827b7533d9a61835de42f9ed80b5d

SHA512
dccba80d894dc7d251c958e4c4877cacf84d36938964137ecb96944a7a9e34625e0a05d40e8ceec44ff54eab6719c63c402d594f1821c40915ef51c08252fc33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580942.TMP

Filesize
48B

MD5
17fc1651ce325b80b2cb16f8aef3b4de

SHA1
95f82d3e9c9d6d7ff7832dfb1eeffa58b1178dfd

SHA256
dba7beac809fc6f4ee046e2949475183ed280109e41a1e4203846b5bcaf5187d

SHA512
e7c0c3f415135e9296947424a65d043b5cf22f6218fd71d14f91bed9f807f73f65211b95722f1cafe3f80004497e56f3b48c35575017e94b54fecb9fb1de6d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b70c71fb0c6849733b4a76fa39326dd7

SHA1
df56b1e9a55f4467c64a01e40bda25bf442c493a

SHA256
6833946ac512fe51256a4e2d0051f32b9d9041b8faf1cab2e1ff122adde6942f

SHA512
e371534157fa29deab040440a5e1c8361582974648604bd1c7071cd40ecf9ebe5c0c28cd2596c2aed0f110c23dbd659bb55c59abc3bfc9f200fc7902a4a5f24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
75b4c1fc113b432f200570cf9cd840fa

SHA1
23ba3b83234b861a1b476a6fd513067e5ed2fae5

SHA256
6acf8fb7122f8da15d33988052436b5f6a114306d128e23b9759c81eb9a06951

SHA512
3ce2e98893b45e7e3161ad8293fe9764c42426f6ac90adc9180acce8929eae9b7d6a79d08ac86e1bd6a7ea15bb19a179e3f7fb83aec38cb168580def6ff7f767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
0134a74a700c3e5792bc7ca5d2929c5f

SHA1
9ee00d22084527db29cc5fd843c3775fc75f3aeb

SHA256
b3b134f1e9edee099fb23d518b2fffac9e6d1af8669ea7a88211db82ff5e5eb6

SHA512
268a66f43ed4aa4dae23f62fc3f83fe5917a3d269cc5051a1dcf23bee094c1d0553af61d87e0a14f8ca76a3660ed4f1b5e547f362e40c7626d362abecc572999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
db327ca204d5d3be494bc57107c83033

SHA1
030c2b8b49ad1fefd6060d3c663e565348aad82c

SHA256
d2280c0d8bcb9f7055ce80d49b7d6ebf7c5fe67aba7cb1f8840a00d4a1b3018b

SHA512
b5a404734778c13bbe7afeaceb99069da685cb5e83c3fc59960c5a08d590d6d48e0f0911a1189b3c066556c8126ea2031b882f76bfe4627a886f76b00588c7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
678ab35db31bc54d8f3a5fb0631f3ff9

SHA1
17f7acfa6550a3d0b123b2a4d959ef5918b3b2db

SHA256
fcbc019e2b1ce50ec2121523a12889d5412138887201e1b2e57860b3ca87d10b

SHA512
40e27fb50dc5ae9ff376a228f0727e7a3a3028cda45713da7c6de4da407af3ba54ec557e98c96ac9148a0d6a364cd8d7f05eba69f907e653557a5ba45c690ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
aac7d3b4ede4deae571ee27e2778b0c1

SHA1
eec441cc403658d367680f8dde9caa285a52a59a

SHA256
0540c9321422024197832d3765c8c75edba9c8af3577bbbae4cf95170082edbc

SHA512
442cf03c0973dfd0a6dc20bef5640c4437f022febb3f72e3c5bfe32617a515e7b2ad3d6907b5e36839cbef44d8628eb9a52f89aa2a209bf76c35666014ab803e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
79dfa1917be69b7f436934e894b42457

SHA1
5990744417c8ece7e531f966d06c3e98ebb76c54

SHA256
706e70ec6476dc033dc093b4b00d5eadada7b4a42513908dd5037a7a732dff0f

SHA512
d0524fe630ead07d168d7f30740e3fba4c6d7a59adff7cacfa5847b73d5efdabff3e1f8cb6b41562f851b2e44896ad5bd73d769ca72ef79b31e464949943c610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584c66.TMP

Filesize
203B

MD5
1dd64230dc6cd0eaa17c8cee22438acb

SHA1
198a035989dffde2c5794b860a33631207472371

SHA256
dcdfa870e7332a857317dba355ae50bb732ea49cde16144872dc4d8e96d1fcec

SHA512
0fb0f8aca7f5e60688609a45b3f2aefc9246d990ae4b94d5504ca866182c72c5a5d7601372521458f7cc78b554cda45db1c85a59ed56e2c623f52c56ba373270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1519e2b32e9d38762c686442a1b1b9bf

SHA1
e140bb7ce26e9f38495aa00dc53b76b4076d9acb

SHA256
bcfc142f97d37daae60c0e142d5a38a79ae74b0a1742b504538b16ddb8b42b19

SHA512
6bd5ea6d352634632ec667f054c15b98bf70fbd7b354d8d476362798f9edb4215ad7376742960bae520084ad44268c69e385c9a0497be0edfb0e76695a680827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a6fbeceef4d3ff751f11953d364c4e43

SHA1
c0c83d58c73ba43b8b0fa2af34bbc3420c817e6e

SHA256
e1baad577d9add97543ba2bc8ba5a5edec904c612b4e493f509ea0e0fc618931

SHA512
c0696c90dbd4a90a1c85af1298fc095e1acee25384decf99bfc28a6c7d1984f9a50582ad4efdbf3ba4cd8269a98acc3f01d33b597b06ed161a718ceb4d338882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
16c814fce116ea6e454e718b560a5e73

SHA1
587df76e5e5b39e0eee5221b1a4957dd4d03ecdd

SHA256
b2baffa597b95c0f7979a40430025e36052e399644b2d2109148c677ea4004e1

SHA512
e49dc6a530b0ae15efbe0b81985deedf6bfad67a563054761bfba58b41a80d77d8f5747a24893b21eb28e791a9689556ac0b415db10f28e5b0e37892249b03ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
12c46ae79da432c9b4fc80cb3430e92b

SHA1
0d99aebf618c1543d2fc25f0667447d21acaa0c6

SHA256
8dea721b5ac1ba2ff77401837827bd2277534826afbe5a1cba56824108e8e2f7

SHA512
7dd5f8619b30dfeccfd7d4e71ada71de19a2721ab4c87cdb690e16aa2f7e57da0b03287edb6ec15a338de8d268658eee5837656e55732716f9271b920ecda871

Download Submit
C:\Users\Admin\Downloads\FIVEM Spoofer v2.0.1.rar

Filesize
49KB

MD5
62ea69cdeaa12c133d9da828d8ba3401

SHA1
7c6ce70edc31df775b33247de921bae71d6cb840

SHA256
e9bea6465a06ebf414dff5f3cd7a869b96999e6e362f91248f87bae54c53c498

SHA512
ba45067e6fe30ce4398171613709aba36fb5f1c41dad4bc6db722c5c4ca0131ec8edc740f03823ac07e4b1aa17536c5015e4f7b42feda24824a891ca2be7b4f7

Download Submit
C:\Users\Admin\Downloads\FIVEM Spoofer v2.0.1\FIVEM Spoofer v2.0.1.exe

Filesize
85KB

MD5
a63586f1478b1a6ccdfc243436ba13a9

SHA1
dc6f913c7b7b1961f0e5cbcb21db6babe8bd0c6e

SHA256
c3820247a9d7005a14428218a4a66d7636258806498b8921963e73eecba9e67d

SHA512
442c75f0e3fef39cb5b81bb80e621bb5574d386ffab7d1d170469368422f4678aa249716cdca69b1deb25da4fc1a0f5730e4495f4f29cb0d78d29bdc6e0a4fd9

Download Submit