lumma | hxxps://uprootquincju[.]shop/api

Analysis

max time kernel
208s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://uprootquincju.shop/api

Score

10^/10

lumma discovery motw phishing stealer

Malware Config

Extracted

Family

lumma

https://uprootquincju.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
77	whatismyipaddress.com
78	whatismyipaddress.com
79	whatismyipaddress.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
655	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	1000	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133853900150847199"	chrome.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
4676	msedge.exe
4676	msedge.exe
3884	identity_helper.exe
3884	identity_helper.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4260	4676	msedge.exe	84
PID 4676 wrote to memory of 4260	4676	msedge.exe	84
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 4592	4676	msedge.exe	85
PID 4676 wrote to memory of 1000	4676	msedge.exe	86
PID 4676 wrote to memory of 1000	4676	msedge.exe	86
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87
PID 4676 wrote to memory of 1868	4676	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://uprootquincju.shop/api
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2e0746f8,0x7ffe2e074708,0x7ffe2e074718
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8292 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8276 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:1
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:6708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9956 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9968 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10100 /prefetch:1
  2⤵
  PID:6740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10228 /prefetch:1
  2⤵
  PID:6748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9960 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10708 /prefetch:1
  2⤵
  PID:7236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11252 /prefetch:1
  2⤵
  PID:7404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:7632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:1
  2⤵
  PID:7716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11556 /prefetch:1
  2⤵
  PID:7920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11700 /prefetch:1
  2⤵
  PID:7192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:7744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11852 /prefetch:1
  2⤵
  PID:7900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10364 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:8060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11600 /prefetch:1
  2⤵
  PID:8184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11996 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12172 /prefetch:1
  2⤵
  PID:7488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5760064500320665419,6040008894634262964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10352 /prefetch:1
  2⤵
  PID:6552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe2da8cc40,0x7ffe2da8cc4c,0x7ffe2da8cc58
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2092,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1884,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:6416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:7196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3704,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4660,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4804,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4764,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:6712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4740,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:7116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5364,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:7324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5180,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:6508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5488,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:7572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5840,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5372 /prefetch:2
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4708,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4640,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6128,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:7044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3316,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4052,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5664,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:6720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3560,i,7105284091838411303,12929092106102211798,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7136

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
2ae6b88dbb0081b6ba077cb74f841d45

SHA1
fecb18e22d779857fb7abf2de9e2327a2175231a

SHA256
2c9ee9118966bddbb9a666e23a860786566d758c27fa02e04ef2bbe12bbc54ef

SHA512
790c412f9eba15072df868984a1b0fed27dd5da08aa537d970d6a42d8403a2bfe532864fdd56acee805b11c8e2cac005ac1d214807edfb9cd8eb2b4b19f8eb0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
197KB

MD5
dd225074e0529feaddc1b0206f61246e

SHA1
bffd2201937c7457a89f044bf7ff89dcead891b0

SHA256
b82c388af45f49030867c429ed587f45f5d7123de8d262261f5d4d569b9576f8

SHA512
a0ac5f9d2cbe62e5955d6aaf8c8691959311f2239d00ff37d2263833fab2935841f5476a56e19d872df4467445b9c3599bface1ddd615aa9f29bd8130e365698

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b8fb235e7873bf592992574a09205373

SHA1
6ee35c8a3179db76f868f881fc140b4769fc0c8b

SHA256
5ee86210cac88d0d55ff27e7a1890bf0e3c7ab1a9eeac249fa865d4039e57ba4

SHA512
fa9e88834d7e908ef8c3c5ccf91e9ae59fdae788b98a94a1befac0820d8187b66f5e2b988a431ad4d0ad97bdf69fa234ed5694598cbf81c1c8751ab0d1747657

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
6f07f11fb008dc8d24ae4b0a07caec19

SHA1
cc6a4aa886592e0382b036da723878fc3f4981e7

SHA256
80988741689c8ffb568116eba17ed7e25921e6e928e4aa2953c5728e50948d46

SHA512
f9e181541a6b5a4abe4ee7b4dd9966334d0f80f268e82c6f93dd248520ab1b46ee5c3d191131b3fe329932c5512f3f5ac9c00f3d1285319af5e6cb82104d47c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
53dbaceb89c759c2ba28234bcc40948e

SHA1
6e24c619e01e387b7a895e6c44736683d452d149

SHA256
0317c06677957dafa48297dc5278d2b0a95341d334661c0624709b0f7b28683a

SHA512
293f8ae04f4a1653a7c881a6b8da4617f0726c95c564193cc6044583b470174084b10fc7eb7f01bce335e1cd5673910755c8c52c82e38264d67b7e26a8df73b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
dcd4ce4e022e923267937e0e373b4db8

SHA1
4d983c44d5b7bc340205d132e32c90693fc70e9c

SHA256
99dadc502a1c75b718b2c6d59ac9293899584d5af1ecc1f3b113823bd48ed4d4

SHA512
94580091f091493e228a014a34b03b1a607db8f326121eb0da1bac1a1f037097d4f3e1c9cb30b7a8875b7e2d67f44bc3303447e7ff08ecffbac5d3bb081ea719

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
9d867b2acdff3b719297812eee1042d6

SHA1
09d67824634e8050e56a47ee5ac36f41efa0c770

SHA256
ffa9a2e5833fd2b7af8e5d8b0f9886b19cf11c90ee67ff9964b958ea574af7ad

SHA512
2a6b26e5ef972720951904425aca4d74ca45879f9e6ba6aee2b9cdca85462b081e5dd9750651e584458754dfa271ba9c846d7c771fbaa3be7cfd809805fc9599

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ea8534ecb67ab86780579895d7b1509d

SHA1
0e14ce885c1d47c72e68e0ea5dadec8bb79a071c

SHA256
d35d75822a812be996d8e0b18fa8ce306b57064b1bf7c47a4974dd0642ccf910

SHA512
c8b007ec8fa23dda28e5ab89dfcadcb74b64b5c78e071ee29bf79b9533c0020e7814f276006baa43d203df8783a94423d5655023015c37778f68017ce4c144b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
92e310d33fb86f5d969cca0a2394cfc6

SHA1
e0a80ded5d0205cd402432a0f8079c50fdfed2af

SHA256
d5751ecf888239f3c28947ca9817102e3278da2732d9d98c29c32635b5b5def1

SHA512
9a2f22468ee7c7407703fb73a0cddb04ef7794f9f8283b094fa1f53c22f0ed10888f9f137f996c2debd31f9225648af6a1c460f76cd66b286d21addabbddee87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ab054437394a09c78dfa6e25cd85aa88

SHA1
c323ade13f3a41a3c71b700715da28732ce54c96

SHA256
b21b44f39df0d776dd31fd88573fd40239a82db4fc277d4f91fc4460c0b4ea9c

SHA512
bf30aa6d86e5b9f666acdae2246c8e0f5822aed735140e18638f24cdd3a526ba52f7d2f100b15a47457fb1415ff3369eba0fed3e8d4a075844d003ac871ebd5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a4c4359d711db3d2795734b4d13ee2ef

SHA1
8269a2f594b2639cc253fa7cc5a499e21d876ace

SHA256
d2da125a83f2fd5e37d4fd821fbd5ac80f11ab0192073d7bf5f4ab9414be158e

SHA512
009ce89022622f2c57b05bf6f5ffe8f79b7dff8ee4591ab14af0fcdb3b54ba2e28718acf4ec78d42964d398877262b1866642d3f404c34deadfbdf1e59465afa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cd4018cda568267c64f4795192340520

SHA1
16518180d03c41064e2a77ceaef335fbb12c7a61

SHA256
39deb8aaa567ba23cb404002da0917c882bc8e7442b14281848cadb481148dae

SHA512
7a153dffef4a9e5be47e69ca4c0295b4df11e109ee1980aa5b4db1bfe2338f6f74e06e7a5e9706953e7f505bdc81f68452c4fd4186ebc6f24c969076e2af981e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6543016ffb231a5bc289dfbbd85faced

SHA1
d3f9596e1f99283ce719f1c31027356163464e56

SHA256
7838d4a5bb74b5125d1185d428a29e2bb67812bee246ab82e6c16b772cd1c077

SHA512
043a2d0c76ee4fbe0841cd868db43f27b270e0cb3fca18c8f1e8ba3b13618b7d290c5146ab4e8fd821e653bcd69a2f23593f0d465eefbf0784dd83caeed65c3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a20ea77de49d6aa39532fd43053b2e01

SHA1
d35ce83aed57b6f5e1ef4b0183d4cc584ede93e1

SHA256
eb9b400e6f16d2c9e23d46b82d26caee02a22f58b94bf1ca3fe66569e513a617

SHA512
a598e1e4b760df6b859b818140d7218af28cc8ac0c1463af861d5b6e606a9c26bf004815ef7e7fc12f5fa0b6fef3ac482b56e95c059ed16864f9b0fc8cbaec55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
acdf43ab00e9a4730a0bf7390b46d2cc

SHA1
bb1e08932285862e9e30b91080d7af860c575fd7

SHA256
a2cf6761baff3cde717118cb03054d9d8527f5b0d2c4b56ad32b005b75d02507

SHA512
519cfc030ea59ac696dbc9c8ff3d715e6283dc3e75e04575c8976df7ea47fa09e698127208e422929f5cd69acd81bfd2f1f5c7965d14269591e8e98a7faf9150

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
79629aab688511f2eda04e01bca41887

SHA1
3e26cfc30c76aed7ac439c601908afa58e965967

SHA256
4501419a2f97b9e62f05b550f5707022457929509de9cd686531aa8e94f64c38

SHA512
bc4eecc861ab4db05caa95eb62b855aac84c6e1ad0bf5acde8ab458af054790517f32df79b6b0d0266effcafcac7a717e27f6e6dff2893a336a3ecc00dbd0b94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f408e4f23345fb8e9030c46c06dcbd68

SHA1
f2167e69fa50fd49d82e5f94e6e2eb0dc779bd90

SHA256
6066d390dbc1fbd7fb3c598c5af6ac2e4bdceadc0a1b585dc8139a2bb4c1b5eb

SHA512
1ea3769a784843a8ad039bdfbe42d186e66ba4a08b9290078141a6065a27c58df6fa33a589a5e9c9af53ee2a2d1e4a2102a170b80ccca4c474d259d818f65f78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
9aaa6fbc015af842a882262dc2e52f4b

SHA1
85195ed9213f37bb976d545973a16d5fd7c7064c

SHA256
699dee41993975021ea52483b66204d75ca22ab1e4c29298f9829a7a35efe860

SHA512
52f3d840ad124bfe9a2bd28699b9d6c2d2ed5b38c59f4344c91a227c0fac3bd149cc59d18289fce7b90d9801d8b81369ebcc2b6a26394928f77fbe7d8aed3313

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
544f12f9cc049507a74f39a39b4c5125

SHA1
306aad6e812ded7abf10380e75a107224db1302d

SHA256
5ca2ec58a67a4cc9fca6494278a8fb9e014e99aa5cc03c553b316de0d717cfc2

SHA512
e3f0a4b0dcad6aedba90a3469b4c7468239b5cee523c7e90684fa93dcb41e77649ffc3c65d192a69730df75bc2b43b6f2516cd314fb807fd2508f2613a10009f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
67e5613adbfae7969412827808f7228f

SHA1
8eb8c03901774628eaf87ea00248d7a2943a3be0

SHA256
47de142ccdd7fb68164a2e3e2a5d15a3dde2868691f655641384600bf54b3467

SHA512
634d2cd679867940dddf155b41ffcc960e66c3f062771694156e13394847f66fe93389340792f3ea88bcb980339bcdb026a0ab2082de466feff28809f19cb7dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
90fdae48790fd03418aa96301d79d54b

SHA1
93fca4b1d8f1608b772c4603e8404708b1619852

SHA256
33b52803ed75c1b5fedbd29f5c9dc9e909e96057f61a9abe56993deff0c10043

SHA512
879e4a7d4df892820f914e17ca910f63ef8884954792362258e3323861825fe8dc8dd6d9718322693175be5543e97f5eabb00193611507cc3fe085e0fb83c7d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6738f4e2490ee5070d850bf03bf3efa5

SHA1
fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

SHA256
ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

SHA512
2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93be3a1bf9c257eaf83babf49b0b5e01

SHA1
d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

SHA256
8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

SHA512
885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b6be13f0fd26b485857e3e731276f3ad

SHA1
9c62a961fb9ee8724139f457979aae035baed703

SHA256
08f095d7fe898ce56572bd18647b128d4e5dc3257b53a493d95767e43cca3e92

SHA512
66f769aa5e3aa921d4d1cbe5194534a32fbb4c57af3a4c42a9ce630b071c3579fa46d6c251f3bdb11ac3eaf10db60608ea06701dd6fa3a08065d70310d80a212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
18KB

MD5
14935587651f8029df8be0f192265a52

SHA1
fa88ece71ffed1a57fa548a6993a29be60e260b7

SHA256
b18ddf42ddc3772a0ca99995fb7018f9ab57d841dc4758b47440c5d6ea794b80

SHA512
144ccbcb300aa0adf749f6c258df801ecfdfb1168510d4b94c8498c956bd9e0afae4bff4d82ab696e4da43765eedf18b396d12eae39d5ddeef997aea47a53162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d66acfd5dfb8b767bc36e91c8d66a6e

SHA1
8aef537e1e7a512c08a0429c5c608f7407531198

SHA256
4bf094405d687da9bea2480b41cc43c32bf94512ef0800c6df63e92cacb2270d

SHA512
379c891fb03721fff82d80baea6df5389ae8120305664b20a89bce4b4df4e6a161e4e3e76f6071cf53a6f56dea1e10902a9c748b0884e7790e8c953aa2ccf159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14ec8af66e2458073eb0ee56855b4d00

SHA1
cd8afb172ce2c24821da7b226925ec86841f7e86

SHA256
c79ee9b7e3f31d1aed3edcaeba66ef42fd33f553efb67c2f81874090fdbc1795

SHA512
17f0c987dc05a19c620ac9c326f76ef98633a08314d03921fad6361d695f20e22451b591fe8b402b8032853107948ab15ccd2e41c5c6532c6911c130591746e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
1774d42b9bb6a0bb34714921ae7c4f4d

SHA1
f143bbd937174d9ac277f0f2893d20eeb321f4ac

SHA256
3014906c24a20511e2d266ad1c3132df36891f82d4c62907ee86292224128479

SHA512
72807b566b0a0ac6a661c1cb201c58a67b9fc08355c9ffdc649bb4c6a47f7608b78d1bcc663fc59f628f14b32230d939878e1b5df8be2bc661c324e34aaab6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
45e6088ea0afdac166aabd384f2f5f18

SHA1
05be752acf3ca4d86424e367677bdb8048283feb

SHA256
3bf4aeddf6bd29af1a7c1d47487b51661b4845eb80b721c6f5ea2112e7e8a2a0

SHA512
93cfdcf771211772e3919542aec8c45db52849955d7b4cab6161acefdff4ce45563c826a91ebef1ea34cc0a4ffd1d25953011d5d0b4c86b409a6de347b8df058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8432ecf279bc8e159bc55e80e5d5eecf

SHA1
b341e97fefd1d02e515e5d270e772e9f6769916b

SHA256
6231fd89b8a2223c2375cd1f12b22078d8ca9e6effe0c3b33962eb7d108cd88a

SHA512
ba533719625264c85527878df9b15a47ddee7d2be874216d288f85cfd8b5ea721dc4952fe293c23cf5feff841c2d9cf40dec5a3621df1a21a8ff50485b5dad7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5a9bc0f184ad2bb211ba135a3a281a9e

SHA1
47ac823d0657b7a348e0c22b9e968c79deb4b0c3

SHA256
9e8b754c928fb94b4378206a11dbba7d5fff6755fcd0144faa74bcae160e3018

SHA512
0a9bd22e0bedc3e60cfabd0f5f25544a0692f4bbbfd1a553626f0845c0f46825e37a99f6e28373d8d88786592da69a9b072d17fa84f39f6fdf1e9a723fd6c2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
8fa79d10d0f67ebed1930669304fd6aa

SHA1
4fe76c8e11afb94e4f2e8f83e57b50c228a1bc8c

SHA256
94bd9f2e090f75410ec2a839db4d5f636a2d126358f76819483e25ade897885e

SHA512
af2d6f2a699362241a81392ea1b8dbbabca7448548b69b50df40d1729ea7531a3b6b128bfa1a6719c4b3d90a812c06e6619f7e7c1cf570fef6ba8c146274ff0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583208.TMP

Filesize
1KB

MD5
7055e83d0413077e0d8bc59cdbe48d0b

SHA1
27531b01698b439329095ed4bed9b5c34136c938

SHA256
c607611f0c0bc8cfa7c6a4ee00ed59eea113b3f2109a39eadb27e7272063f7f1

SHA512
9c24466e16bc42fc7de044641bbef595fbb1a4ca20055b65160f4e1676826a8f527c30143f1a7c485fced26a5030c7ba6728ad95175cb0650bc64675519301ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4345222d37fd46a12b40a2f18636966d

SHA1
0f9ef2fefcd7243b85f4c08502690b743a4bef8e

SHA256
c183f5b3291021a8ba15dfc2422d3a9d0c97a544fc24a5a35aba5174181be58f

SHA512
5f9de02c7f97ab0d644b8dbbba5abd692d682f9c9e8823ba5e46535ae174160ae61679d232fb04f5c178c8a152835fd0a22b11beedc12639631c7b6448528436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36bc7c5dffcbc69bb79352c599507c60

SHA1
f53f1b92b8d498e1b9ebdba021058df598b01038

SHA256
3f678262a9d6d9a17349e947b59df22e6bcb127fe07557802d06e7a196168794

SHA512
4994cdc7c24ff4ba477367a151bf313cf0c2ba61c147956a56a0b96c2590e498928caef704cfd2c63d10f79b6d7cd7977ed4006cf12fa8e1e23ebeb0488bfc72

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c64fe0d-6b9d-42b2-aaa7-a1a81cfbe67d.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4072_1316345039\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4072_1316345039\c3913ed6-a737-4d11-94ad-6e38e4c07871.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit