hxxp://ainude[.]ai | Triage

Analysis

max time kernel
2641s
max time network
2699s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:29

Sharing

Report Analysis Logs

General

Target

http://ainude.ai

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000004f9a47b432a1da0185c2252a3fa1da0177b92a4e92cbda0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
5052	msedge.exe
5052	msedge.exe
2984	msedge.exe
2984	msedge.exe
3160	identity_helper.exe
3160	identity_helper.exe
1304	msedge.exe
1304	msedge.exe
5932	msedge.exe
5932	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
2944	msedge.exe
2944	msedge.exe
5740	msedge.exe
5740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

Processes:

msedge.exe

pid	process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

Processes:

msedge.exe

pid	process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

Processes:

msedge.exe

pid	process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

msedge.exemsedge.exe

pid process

5932 msedge.exe
5740 msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2984 wrote to memory of 4604	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 4604	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 756	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 5052	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 5052	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe
PID 2984 wrote to memory of 3548	2984	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ainude.ai
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7bf346f8,0x7ffa7bf34708,0x7ffa7bf34718
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
2⤵
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3580 /prefetch:8
2⤵
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
2⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
2⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
2⤵
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
2⤵
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
2⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
2⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
2⤵
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
2⤵
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
2⤵
PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
2⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
2⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6812 /prefetch:8
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
2⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7004 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=212 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
2⤵
PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
2⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
2⤵
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1080 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
2⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
2⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
2⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
2⤵
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
2⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
2⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
2⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
2⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1
2⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
2⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,2938126304875640690,6690858302396197337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3164 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x378 0x3f4
1⤵
PID:4032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3960beaa-3fac-4aa4-ae80-cf93828fdd0d.tmp
Filesize
7KB

MD5
24ec82fc27e4b3acaa0abf24079f7c19

SHA1
149f288e0377b49dcb91c0c312b3fcf992ab703e

SHA256
b05cdd62925c0395b6333c964d5cad37c7207d92ebcbdc0a03ca4c4123711b54

SHA512
0cd69a7ba4a0072a65f45774cd818c2ff498c1b931b2ce051d38f76590853b56a1e3542b7ed2678542a233cdf5a28b7c64dd90dd0dd501c4c0198f6a887bc772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d92e5a4-f572-47d5-9f32-9d5cdef94191.tmp
Filesize
3KB

MD5
214e37b6c63df71a26e4a87d0aee0959

SHA1
f3d4432bab2cf6a9cc51490b2efadb84da90e27f

SHA256
283cd7a610ceb5dccee005f171da90654cd91622ab7d5534ab6d17b8e5b6e5e4

SHA512
82f926ab69e33cbdaa14097f0d9bbbcefee9b7829601d94bc9b70cf1d6a85c312017ce3b22885fd6da613857daa0cd618d9b02c957362352e948d674f6290709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000075
Filesize
172KB

MD5
87f4892c0b2b103c013e3ad82a1dcf0f

SHA1
0141a3952b500f35d5ca2c58909ca78dff8f7afb

SHA256
79fc5983883b56d1098c746e802d2f4fb686636eddcb390b8ee9d426dd549503

SHA512
9d20909d09f86adf7a56cc93242c1e7ecc5f55bd8d250747d11f08f64a9c5ae2bcf3c359bbb18b60fa42a46be21b57380532b5b1cda2b838d75bdd8a0d5b6a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
fc0041e8c724e52445baad21bc34713b

SHA1
9d57d452a3c5d44d816fc2dbcc75433ceffb699f

SHA256
2525d35dc1673456c9127c87e88f0cf7a09ee5a0c065d76f0f49a5960ac80130

SHA512
8999a632c2a4c433992604d42e39090baa5c8609e099c8eebb6144de54a62299c743f601ec200f31215bbf0ffd47904a880a85eea21c14b2641491ea5a5246c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
7KB

MD5
4eb5cf416e718e8ffaacd16c2f84ba4a

SHA1
79af31a29a885d1b98006470208d2f8539398f67

SHA256
c42ebee781980848e4f78021bcf8b4524b2304a6303c3498d7636ee17ef3acac

SHA512
4a5708a1a008f96e42b4a029190c5e2392013160e448126e86f21f15f64ea447157daf727f769e6d87673da2ee6a56015bec44ccd14400fbbac4b72f71948d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
7KB

MD5
b59c1f2041081ea35c15e970b5f2fed5

SHA1
bc7937cb2c8a9c29c95c72e0d8e3c19937dc5c10

SHA256
ab5cd61f3d5d910a008b8ac3b14d9bc09ee0265197ff6a4956a917737b8559d9

SHA512
a8ea4d310db28c978d40eca002572fe8a1662b2b0467f4dacf33d8a0e41099c1bbaec14942476117f4bd5016261a48a61607c87f52a148d0acf1d0443bb53628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
f1dc6014fbd466c1b4dee398c7e4085b

SHA1
1d62a8c8cd9ec61b616dbf24d611c8e5313a9474

SHA256
4198abf317919a198212e2d149a5eac582aa7168fcc4c6839d9d3c01e4e3a779

SHA512
cef0b0220645a172424946e7458ac260ff4f7c82d95231419b4173dc440a63891f5b97918e261f50e3722b85947a167e3be0447e4422dfe80a1c70f2ba9f4f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
7KB

MD5
dc85ac1814402857ee0cf4095d5fc95f

SHA1
f31d01f37589fd64e5e558657546e08eba7c345e

SHA256
e9c9c448f3f251c6d383ae3109ed3e9e18bd8e2fd53abe373b50d1a05354d314

SHA512
aa898142107d278f000a91c2d1b6c1b5fdd84fda994ee834f91a81d4a6a8e78a219401c3b6a343e9707698c917c1fd87d4fc5dde0aeb868d459daa868a236165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_penly.ai_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
ce58fe989721e108babd124ef09674b7

SHA1
76039a701f4341366804ba92b09fd71ea3e8162a

SHA256
c93d4d8e68a344d09b35e7ee357e7e08dece5fbc96e9126340ee5ae06951b760

SHA512
fb863cc8c548e2af78cd0ca05cf39358ed5ca16962eb6eb11a2b974d952cbf8fd3dae6cecae003c4e90876b335301944017d2f3d6fc1a3b44b498d0886cccc0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
86e3be18d112adc4a3774760ec37fb2d

SHA1
358516639033b02059c3ef8ad93a5897894b880e

SHA256
e7d0da45fa0ee92caa4316fba0a4329fda38555d18ab28dbc75afe642ce8b6c5

SHA512
a25865d0f66620e077e1bf0eec7ef2e3b2458d22ea5a4079316ccf0372b2b9497bc03bc796f55b9cebbe0b2f8bdb8e2ae0e12e6df49e41c7c6e4189c9a0340f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
7KB

MD5
17d3f6cfc4bd1f2f5418ee20c4bd02aa

SHA1
cef88c4c12d2e2424b9a6551c5880f3497f65406

SHA256
9847b6c0f349b38cadb1783634c90887852ec8353b10410bf7df764f8d4015d1

SHA512
4eb7ea080493c8a72a48ee5e3d0fa5021344e81a2e67e106579f56c603463d672ab96ecdb25d2ce4c9f6310ca37a3db37bff912e24fee1c1516be00c8905049e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
7KB

MD5
59d85bf10dcb4f4559eadce451c5da16

SHA1
2da7bd3dabe97eeaaca3648a6bc71e6ef4ca4afe

SHA256
1911d88a550893fab87da9183328cd0a0d98435bf2fb3bab69fd1d9c417cea48

SHA512
0627800f489db69096d1f3fa27328e2e4ccb48ff5455fe7c64b4eddf720b8f06dcbb2994c2e027e24d91b671e3e0e5c50b6097acac3c9e252bfe15adb23d6eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
8a9984fd9945a971490847bd28d56a2f

SHA1
1e40563259c9bcdbe6b48845ac4d40a5c6d74813

SHA256
821e9f760102a7766647dd4c9d65e9139340476cbdd42e359eab24c6d5e7e1ac

SHA512
d30219836dd44722f8b4389f00f0ea465c6cf04099bf7a3382293d03f6ede4c4b359fe2d516cb59b598c00bbd757c5a9efc62df0a1ad5d84269bbd2b56c8ec0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
b7145f52ef946403936db4ef74766e90

SHA1
b2153ac26680df5e8a39a4212030e926c3cb2eff

SHA256
622205e3051dedc6e0b71f58ac72599d51466003d671167ff77dcde11fbea3c8

SHA512
04dcec48bec691fc457cee90f14e3d18c7fabdc707dce02828656b2ce3cf990b6cca049ea0be2ca48aee58dd4636655243416bbc2fce0ff45b23bb7bdae04e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0922ab8eefbd4234329863cc4964bd45

SHA1
e5e7094bd5885b5f10cd8f970539d09231b9771b

SHA256
8dd017988d3910390b4f029b27e36841073370c20ab48ddb56f075bd9656f536

SHA512
b3508a115cbbbd98ba0c1a3d2b860d3c6a116efc276419220adf19a553437b4b6288b17fb67b3f3931a6fc31a17fcd83bdae410136896d7d81b9686f89bbc73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
12KB

MD5
c4c181e8bf8755cc123ef009636750cd

SHA1
598b6f6eba4369f2ad691d4694bca2d36ed5eea2

SHA256
59b8caa9951d056839180845f54054827a5f3cb9c4d1c9da479ebdffa05570a5

SHA512
a973229fa2cc1eec88cbbf8165039e3464d0708060a26b84610765e5da89be1a526de6b61cbf8b4f8d257cc7ab3f4a15e064c64ee23533df2f50366f720c7688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3c11c1307dcf593e7e5b6b90e059e16e

SHA1
b2988a28137c19485452b2367a3a462b904f2a4b

SHA256
c00d51838a33d0b6946707b403405a74d513ebc372eef6deee1f43a73be69bde

SHA512
ede22eb474e575b5c143151c78b78f021f539f2900fe9770cc39df8e6b140b22aa597ba31f565173dca114b704e14ce42e6be6d4e21bff343803f9fc41c19ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
85e017e38e5dbafd62ace3c3809afada

SHA1
3fb22115a3372d502b26c6d3c67d63a3122bd5f8

SHA256
42168a613ee56c396c70b6b903c7d6094607cfa433ad1189763ed684b895d884

SHA512
c5b6e71d22d4d5f2bf6a2eb4ea91895c3db6c13ddd504d22b1c984038b8c5770364c1ca2e941e3d7b50f214308a317cda3afcb0809970e1e27161643191a2e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
8d137eaf2a3d85c5414f7c7402fc7556

SHA1
8c0433432ab10fc7b94e17636fa8f3b205fab738

SHA256
fc2d743e54b5656b63a60131f41b53251f4b587794bfab64d61a1f84a7085370

SHA512
fdce63d57f361947b97e3c108e8247b36de6e572a3ca783c01f82853dcb21953ea4849925818ae2c1a59b24c44c510f4777a2c17eb53cc5f455e5a24cf5d04a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
a0145232734abe1d4e41ba8b5ad56050

SHA1
8af8e94e5b1dd28280739f5ca52485fad482798f

SHA256
bceb8b0c9de1dd17002e30e2a0fdfe3a7b6f9fc92651a2e86619df2d0a711143

SHA512
0a7086606414f46f9fcb11645111409ba2563f9380d7d8251449f0026346a5e4c6d292cffdabccc8820c557a25b6b18c569b1affb584cc9ea2559ef4a5a96bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
f16a24585f8f591263a8c8e6ac4a0bac

SHA1
a030d6f2e0709bfc711f3db50329347b23f35bc8

SHA256
25994a36013ca828ce26acd5c6c0185336f42b86925375517b2c58bff3835f3b

SHA512
a570780c4e86828e9a5cc6f76696feb63379ade079addf7fb25339da77df31daaea4116a44af551b23225e29184b8e9637b0b39881954e97e0decfaed8d2bfc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
043b9863073fa86e79a9385e62df8b5a

SHA1
c86ccec4788b23d446ebd9dd8f2b0b629aa5f386

SHA256
e7ace5fb4e4fae9c35705c024584f022bab56c65e948b97c99b09d0f32234dc5

SHA512
fd50fdaa75346cc1b408c7c6f2663701d591ceda4804855b26c93e4ed73363866a4c4e3be6d2f255efd407c2daed4d65f6f479b4490ff122d4d9c2fbe76575cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
5d109ec42b38bb2163cbffcab2b5095b

SHA1
f2c7c45b19440e8629b62941acd4f1f90a946b2b

SHA256
cec765b8b47168f05ee08ee299cd883e3766318e454a39bcff891f93d03cee35

SHA512
fe14132a020818c407189768941d012b7765b09fcd03927d81b1fb27e21709cd75f7fc12bcdf18f57589067ad9d75a44377768286e22edff2bbdb5b577efcf2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
12KB

MD5
33397f4abf1344e3430f036d7b1db747

SHA1
80c8ac31c6d134ff3b127303e9b5808ced9da943

SHA256
984bf30e74528511c43a83bb61ec0ad6db365d75b31a5096aa277c6248a4b33b

SHA512
b51c57d4c01e1bbf2f9ee9fd718e2f4b11243b808b40ed53b22ffdc1cf5644fabbf70f0e0a79ba7309128d553bf1e6c17a7bf1fbc740b7c50a0d6f1b019b4cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\43eae7eb-8903-483d-81ea-7e39cfd0f1e8\index-dir\the-real-index
Filesize
72B

MD5
09562e1db8a5276bda5f0327f23a8786

SHA1
19f3860cebe6e667fb229b37fcd37d89cb14b23a

SHA256
982535339c497bde766008768419ed2bb45de189aee7f22e2c56832fd8b9e449

SHA512
b5c9277b32c6dac9dc1a1ebe6c5bd4bfe7ac6bf22dad510fbdf99bf9e1561cc86b86bda54b78daddd97ce17d2466847212af84fd68253a1b7024843476aa7b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\43eae7eb-8903-483d-81ea-7e39cfd0f1e8\index-dir\the-real-index~RFe5ff630.TMP
Filesize
48B

MD5
524464d7a3270bec86dbd020b5d1c5cc

SHA1
86b63c563d14c93f008a55fea4a02a0ee6a96d75

SHA256
1efa1c42cfe2e4366f090998d9a3226d429854b87b3e55959bd846004d3ffb11

SHA512
46d4b9052bb13110fb9e62fc6c161789a52a77cbbc28e819eae400defd708485ca1bbbffa9f74f193fb562ea0578831c37684371d29917d8ded629e80c5ed040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\796b7533-0a80-488b-acb3-3c2a91ec96cd\index-dir\the-real-index
Filesize
528B

MD5
5ad95d9c50defda01ac23e98cf1a9be3

SHA1
6eee30b6bea8ab622325aac1718d8c58e184e843

SHA256
cc035efcd3ab8e9fb36e4278026aaab996935944b87f30db91b89bb2fdfabaae

SHA512
5c88acebce39a9a94516f52d9a93629813b0aff2d8e8e76088b500d7be4e808ef53578bbdaa296c61db60ab926eb6b3ad2ea441f9526888cc5560b0508c2c719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\796b7533-0a80-488b-acb3-3c2a91ec96cd\index-dir\the-real-index~RFe5ff863.TMP
Filesize
48B

MD5
84ecbd464c2db48d05e9a313d460f379

SHA1
f9fb7846f4db72092842e92132346a6b05fd8ef8

SHA256
8f9b77924dc5ce9261b25ef5350a7ad72be66e83e3bdb6571b15d0a1414061d7

SHA512
00c85361c07b84b84b5642e2f72c64c13f8880b447fcd7d385e8aeaf2187002ac84e10352a2d90b11ea20ed7d95b6f4ff150c73a4e8f3406b8197aca8b96d0da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\ce382070-33c4-4a50-b09a-40543d887430\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\ce382070-33c4-4a50-b09a-40543d887430\index-dir\the-real-index
Filesize
144B

MD5
061ca6e095d874b7aecf41df433941a4

SHA1
198ffccb8bdf2cafa9c3decadb847920ad54acc3

SHA256
d7382d261ceabbfe323fe6061fd4e796aba28a4dfdd5980b33069a0334414fa2

SHA512
579f3ff1c3dadfa9b5d42bd31830d66f908ff7720121ae20a6b53d3ae498fa835439c1b5a75a69f5104b94e48168ae69a455c9b7c666a118133e3f113230ac56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\ce382070-33c4-4a50-b09a-40543d887430\index-dir\the-real-index~RFe5ff92e.TMP
Filesize
48B

MD5
9b01fd1be15a4d853b3f030899a0b913

SHA1
11295b8969d58a5a71eaa378e1d14133647059a1

SHA256
7c12c4b0eb04763f49ed415a1f8b0c228b2db2fce071c21c6aa7e7b4149a22fe

SHA512
f00078a2f5cd770efeed02b7a0b24fd16124ef3af05de16b00eb42ea1b4c2f0d0ac79cee3eb4e13606a7ad60a085370fa5184165772f87de00f21d40feaf46cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\f50078c2-764c-4fad-a6ba-99f51cf745a9\index-dir\the-real-index
Filesize
240B

MD5
d020656c202f6cbe862312a5d3c29b85

SHA1
2e15fe6d33c4a57bd5ef884c9eb66693c0015c5b

SHA256
a8e10d312feba95e430a7cf3c652ff03e33c61bec1f3406c0ed4a533a56812dd

SHA512
11b8ad1d8469b6b6bedd00a5c5e95566e52685cdf016a645b987e798e378f23ffeef5eec83f84d353d01c676295f75f4396d50d656cd2e4caecb6530c58864e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\f50078c2-764c-4fad-a6ba-99f51cf745a9\index-dir\the-real-index~RFe5ff6cd.TMP
Filesize
48B

MD5
3b4eaea9aa1758f0f0a48a9230b5c4e9

SHA1
dfb853c7f9e8af04b5e733ba4740603fab49fac7

SHA256
01d565b49c78409da9ca9a4ec28ee2d4bef5cfc295171dd2028590cd7ad4e947

SHA512
065f21eafd31bd9db1bf76e1589177512b584d8eef9585385e8c507b76de182b35c33b2ee97e141230c672c01e711a4df32e61de99115ff772fe6f707c0a5d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\index.txt
Filesize
107B

MD5
c6c5a3d02478e5a6ef2ea87cb6aae4a4

SHA1
f51fbad157b234de645ea1d254f30e6853f117aa

SHA256
7f41643ffe09c2b757307a17ec9c02f1e92e27e90a4c6eb4a65fefc640fc91ca

SHA512
e8a444a7d14cf4e49a352a0ef747fc3aec8123a59ac0def5393f158a24930627884a5e003cd2f5ac39537190c5cdba5044c1fa50b3a77a1da76f77e9ebb8ff0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\index.txt
Filesize
197B

MD5
ab917a8956c2523c9c1aa066add9d968

SHA1
47dffbc80f5a8333d326c490f74d90627fb710ac

SHA256
1cc2cd27c47f1f77ed153303ebcea1c18102d2fd3f2c7d26a7a34ef3d88c2fa3

SHA512
54264f4dcc2916ea7c5d4fea4abb101f8ee57d50c651f702c3bd806d96a39859ae048befb0d5b94365641ebf6c86037bd009af31a0d3ddcdc8837d4df38db572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\index.txt
Filesize
284B

MD5
154e0d153e5c2ce350f16a8a0520bc26

SHA1
0b02ebf3afa5a7b85a7e82f0bf6aee28a2a31fba

SHA256
f031ab04dd8c1adbf27d61739f4548d220c0c84a4740199733bfa03d3323393a

SHA512
28e3340feae3fba84f9423e5c5d5861682cfec96237324f1615afaf74d957590eda04469dccfe65db24057be4a255c633548bb834bbc184a70c5241d0d0c7c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\index.txt
Filesize
371B

MD5
fd63d9620ad6cb9c97d09c5a9d65cc61

SHA1
c9adee5b20c98ae205af26056e3d4298e1584095

SHA256
d0a9f48617ed47f6b502bfd8802496aa7403bcee126f66999c6089fac9e77ee7

SHA512
73aa9a216cbfe31300191d0f0799c65cd8126db5f292c4fcc1645fd929a9690c71cb12dff0df0895783b5efd47ee16caedcbed7e34b375d274e1fe668a69d060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c855c0312de6be31077b206d301af3ec0b44fb24\index.txt
Filesize
370B

MD5
5157289cadb1813ed73714498b71c7a4

SHA1
6ebbce4f0cdc577eab9b30f1f976486f438df4d8

SHA256
574204616a437f914e6791bc34eea8ee556863f13babf6dfc088909d6ffa36de

SHA512
8bf0197c41e98c12d42bde5243521aa37eb68f921480fed7cca87b4a0aa35ee978a16921c32896c65e940980ca0b51482ef8d0fc49be2e3a1ac6f062ef9cca24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Filesize
105KB

MD5
085074c5f7f2ef0da429a75402bdbc8d

SHA1
18f98f4a2e3e5bfa70959805522415f5bc3c146a

SHA256
6e80ed43cea09a8d9fa88cb84c7fcb4ad9d42938761c2480c733651be44ea209

SHA512
78b2235316484f195dd5ce5ead8bc6b14b295574445094e94e2fb220f96c48f358621cb0760c56a2ca82bd585687cc2b1eadeb61e14819a1655f453b1d5b3fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
d7b7bd038095f61c5d8477054ed9e2b5

SHA1
589b98d4489ca5879479a619b7e1947e9fbaee34

SHA256
4e5418331f63c5daa618cc7d8245e53748cf41b8b560f4958d38155c0785d358

SHA512
901d4b19ede49a65be01b50a51f9004651389bd756cc2d0f7ee51eb654653f8dad96e0e270f04037749b36b70180ef65285fba2cee4a9bb51b8fb3a29d7c7f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
312B

MD5
1328265b5a8f4c40941d213a5ccbc3b1

SHA1
19f2f94d25765207f18a6adc59282aecb2ba70d6

SHA256
2aa025cad699da06587461d0ab19d9629cdb4308c870033dde453affdb07a95b

SHA512
9337001a3002fdf1ee231ff3289e24aa9a4a6c002e05112330400c9abcd47c6e1ed661dd41c5b78fd6eb6555b659ab0e282265b16692ed48c62425ecd632668d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5861f1.TMP
Filesize
48B

MD5
15bad6337750df36c14e1410c72faa81

SHA1
8afbbf4240a45cad23627a5a10f4242e4174ebc7

SHA256
c0f01a039096a29fceb2b636f4f8977cd6187338f9f009bf9030e9e40215437b

SHA512
23e8f4cd1c1094b8c72d847c369e170fb46e52a1c3ff4026ddc509496c6e66038ba2c9c42b1cade07e4e2b253579c731f6c679468991630e8c45a39011a4da84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
3178dc76207db447571391c1faaaa7e8

SHA1
7586097f0a63a5c8ce3dc3d1d308d2b19c83eef3

SHA256
7b01e3cbcf7059dead9488ce7ad8115fb2a6101264b8372cd9f489bea89d9b14

SHA512
7199ee3df59f9c0ba3b5fcfeefaeabc15953e609d289ed1aa659459dcf162581a17e971adcfd5d266720b63a81c5f463414dbe05c2d70ed0e88f7a87b993f971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
1611ec2099836fe30becacbaa5fae9ae

SHA1
3f2e3c1307ce1fb4c709794ef3da7fe854f1f0ae

SHA256
f4d5e89c73bc12af7d7396d8f2d294d07a94719cb8246938d081252a441acadf

SHA512
dc0b9f7b67afcb19884bf752f03458a6abe597b510953f3c204538d2e66c85ed78b2b0e4f4bf34ccd3d73187f70af6a7479eaa6ad3f00d968d267938e8dfd61f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
cdea230eecee969d2dd9d2a0afa1d9c9

SHA1
36871f7f9fd7e93eee691d91fffc7d37f549641c

SHA256
021c9e10ccb936c48603cc8a638568d5c45512d6db16a007e0b389608b1fe8ce

SHA512
d7bfdd9f5d8c5b4a51ef5f2e489d6aaf48114aa22f8a2fec013e9f0e542277b57288ad936fdab89b0df6fc0f629df409118b8c517836a7b4b882ab295bc6d2f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
c0dee0712193204fc98f68d88206fc7d

SHA1
4c75732d13d752e3b34e044531f017fe4f98c2d6

SHA256
b62659b8d28b30ef90c4ba811b81fab5e84a3048a4b3249e24ec4e5be802c02d

SHA512
d58f2c0495cc0320ecfeaf0affc40db142ac0b3cc77095ed7bececcc6d3d5e3c27ac027a7225fb1b91a7b2f81a220d14936801bf32994ddb3db7fe0b7f5bff61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
9f717afea6f06c22409926aec8fadc2a

SHA1
6b2d21e185d04c58541d99cf0c1055f803609af5

SHA256
7b003c723556fae3cf2399114a16b03b358b5c5dfb43958f16b3aff299a79393

SHA512
44beb011b6a39f6eb9373b6e032147717928bf0e25cd0300cfd6823fca4d4349ab8c29505e151fbefb66ed86b62df9fed08f1e22fc6e95cb017b41bf59f11161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
d5be20e017ee4e61da6bc29869a381ec

SHA1
5397842c5b52699c56bb5f6865fa297d88206546

SHA256
80ddfd78ffdfc7f82bc830e2869e8f246e233216189aee729322a492989ec6d6

SHA512
e5779e67336cf8eae232f560c880684eb732bb18a7869c81619b7cc4231bd96a07fa614fe48768ff0d54e882b9d2af04af7dac2a773d202b044032cc8c0b918d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
f6af0a704775a1c385b7c3b2c633fbbd

SHA1
ff4dc6a7b13e5ea59fafc35ca8ec87a3c5c5ffc9

SHA256
8b6beb7ae4639d339afbd79e45b4ddc94fec5701725ad31465d510707e188963

SHA512
0c16ce44a77b530e36da8d7f8676e8529ef8e00bb2b927318f39e160a73a73c10da873951cb33a64d18c19695cc5fbe015bc9be10b194f7711a7ef57f8116e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
95f137840bd32bc0eb3eb2884cbbc265

SHA1
f900c28fc9e61e52ddb71e6c169056667e1b5d12

SHA256
042e2adbac1e3d9028896157602b69e2ce09e155458914820a088e19108daefb

SHA512
3ada02113ea2fac029f49d1c09c1e0da5c8fba8f45094b3a2996e705caf494870e2f71c2d32535da9bf436b2a5da816af0cfd26db49ec5663b89ec04b0723cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
ea168b9bd62efb12731b9a6ae89c87fb

SHA1
e2903061f7bbeb44c9aaaf72f2da091760b2ed95

SHA256
c40a125cb2c2095d4a9124d16dc8964258021de177c24fee1ff7bbc52e039b9a

SHA512
48cc317e6c6bfcafe794a75dab01cc73f0e92d9852c38632a8891f921a6f46b28c629f0342a6daea537e9ffb3976696c14f8a5b026fc5357012dca4dc3daf4fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
3c646f41fa474e1d2a830951d3264cee

SHA1
3b3382cb862ae2414c71a8935521dad40f24e1f3

SHA256
22dd2a790863d71d7ca544bc128adabd180886c26f093d32e0354f9e5a6129cc

SHA512
342943f1652b29cf2f5ff91d66e2b1fdd448a3cc0c1ef2670858500b0ba1d39ffe600996b30a65cf12df81ac9542240511b09f9b28e01be824e85d3747ecfc5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
34280a03a50315fa023072a1c816a95a

SHA1
17c5f882c341665e119d2ccabe2075ea3023788b

SHA256
a12112cefa4fb355326d233b5c23b185ebd787f76dc95b0369614c310100c56c

SHA512
3001f964ab98215a21403cb1bb0f515c81097f5d13695d29e103b690a75ce7027beb5b76675f9fa7f19cda88bc75420e81e3ed9bd83df451381842a762eb5228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
bee4cf156f15ef9f94da1a6e88fba4f4

SHA1
d4ec91a08e6c143f2f556c79ef72e56abb9f15cd

SHA256
c46711e92b2cc80724c79434bf6ffb580396129b8e86b9a6921722b5f3845d0b

SHA512
cfbe4a5db47749c1e1254dc2ef6397ac9716ea9108bb9276e973be5631cb9414bf920bb2df66c1a1941a244b7272cb057533993287340898e028947ddd10577f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
b5a34e84ff9b6f16b0f86e776d2ea771

SHA1
8786235371e458ec943af8dc0e1432647375a8b8

SHA256
67658a2ae5af12d7cb93b368335d529f163970b0062b5ebd3f2207c6363bb226

SHA512
d0c1ac4f6fe89cc7d7aefb04d5985d88463ee4fafb1f3dca70f03eb6e39749d63f3f5b74bf019a9012ecc9dfde8fd0b5f9eea40b6ce2123d462aa2f8f58c114a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
4a8f42720e318e17dcc6c0686a664f1a

SHA1
10d87957a04a37e26671b11ded43d47153b2d5f7

SHA256
457ff096d97288e7ce5d9ceed75e2487e9a7835ab3324700eea75210d3604832

SHA512
0fa059cd9954bd545c651822237699bd389998d6a60230974a34d602bbaa4e5c49291a3cc4a2eaf7493c686987040197d0f5fa87c2aa41461c9a3612a223142a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
111fe64d1bff77da860daab0cbb7f7c6

SHA1
9faaa0657fa60b834b759cac1dec4f9546955a91

SHA256
bc9b3c5d77fdc43586313273809fbde8b2ed3f7875f5ff4dbc5fbb60a1dd0f41

SHA512
492aefab1afda353824e614878f02e347fdd097be228a2e32b738edacf8c2731856211cfe7a383c7b6529250ae1753288af60f6782c0c13a275ac03f7c3a6073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
2018a6074c18d5523165299f52097903

SHA1
14b5cd24a93f620de897455b3414ec8259e6eab6

SHA256
6d1983fe823c8d04b216cf6790fc8a8a852a7dd9805c0a76ce05b714c41d2260

SHA512
2c9cf82341db351f4c589577be1fcac53654c0b93ef4fb428d1a5b490da78505221a92c037c1f23d2cde5165a6fc3c000e5a5fdb476b56361c8c5bb6e6c4fdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
da8b3e3733685f2052daac87eb56ecc4

SHA1
660e9ca608fcc6c8c30fe6afb3cafcd1efca5450

SHA256
b20710643571bdb189c2ab3b7cc7833d52491b59fb8017bc28a1814c618d4318

SHA512
dfd6b5ca571c46f7814ce1a953300eb7c65d7623f7853f4b3fa5486f23b6e2b96f0dc768efe1e424c1280b7a27b15badf037a604c49009173148d98cd35a7e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b362.TMP
Filesize
706B

MD5
aa4d53a001b882682f1c508119d0eaee

SHA1
07741cd66a5b7366275a811a0f4b9fb31fc954c5

SHA256
8120b954958ca5067b53014b675412874dc2440cf6c6b296f25d159e875e8ad8

SHA512
330c073e621bd177c777c4ef945bae59e64d20d3ec76e85ca2d160048a2d68cae737d13df71b9e9e8da48d7ef74d574c7e7cc172865d48ea37858263575831f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_00000c
Filesize
17KB

MD5
913728da90cf90d8e78af59c60b47c3d

SHA1
f42f2a545d4fcaf4f76d0f060f52e33a47df7f1e

SHA256
b0b478f9aa6aaf8d5811e296047ae1f8ee07f4c4998fe9d7b960755ea1fafb82

SHA512
3af86e053dd56aef03e6f967a49b1a0d492616a71e2e49090e0c8e5cbe58ff37ccc55e91f06bf34096059a49f3de84b0bca587f3f17c366f97c0f7a0fd17c974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
6e39d25a0c6651e6435c4dd700116a2e

SHA1
d34b5f69f94575d15a5dd3f2e317400bfac50518

SHA256
199713a7b640245246022b3b58fe5fec94675066d42adac9ea20f6b8d9ff2c26

SHA512
17d38a12e6b0f8ced7a28c8e317f2377b92f7bd12ec1c7996b0b397eda7adfe74a83b3844a2915240524e0e4672b1c643e44987fb70aa3e71c4820d7f076ffae

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
10KB

MD5
204d3ff533feb3a2e779658348858e58

SHA1
226fbcd8a83799b31e90b4d46ca3dd0c1f2a2658

SHA256
158a72170fd948e842f583f76522f73d0f23a29035e9d8e97f2514f29baf38c1

SHA512
1278a3a5681a20708fabfec88c4ae97cdf856da5d5688aa4a5bf48e23528e7b0ab7d322e82dd2ba50fe8395e449afd760c5887eaaa4a6d029238241191d90050

Download Submit
C:\Users\Admin\Downloads\duos_gamemode.jpg
Filesize
167KB

MD5
f3d83d0915b07970d2a94c2a5100be9c

SHA1
a81242c552caacfec275af44cfef58e529919d04

SHA256
c3a5c547734d811f9cabd5c691073e9983f760ae953d26de15b0aa09184483f9

SHA512
ab3fd3b808a16c8bf673501931c1c088ab982c3f851524a91727719f2bf573bf7d1f3dbbe6ad7fbdb92fd0880ad314df2a0a23b6bce3c19a14e9f63f661dd2af

Download Submit
\??\pipe\LOCAL\crashpad_2984_KUFPWLOTVDVVGHSB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit