hxxp://http[:]//b9e62ce10d663d3d1a9111ad6e186af024320d2af46879e20ff3d3508de30a5a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2023, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://http://b9e62ce10d663d3d1a9111ad6e186af024320d2af46879e20ff3d3508de30a5a

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230515203845.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\47196be9-b2b2-4f40-ad84-201c6caaf4f8.tmp	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{738BF6F2-F360-11ED-8FFF-4E963766237A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31033197"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1213608643"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31033197"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1237982096"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31033197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1213608643"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390948086"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
1860	msedge.exe
1860	msedge.exe
1836	identity_helper.exe
1836	identity_helper.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3160	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3160	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2472	iexplore.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2472	iexplore.exe
2472	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2112	2472	iexplore.exe	86
PID 2472 wrote to memory of 2112	2472	iexplore.exe	86
PID 2472 wrote to memory of 2112	2472	iexplore.exe	86
PID 1860 wrote to memory of 480	1860	msedge.exe	87
PID 1860 wrote to memory of 480	1860	msedge.exe	87
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4676	1860	msedge.exe	88
PID 1860 wrote to memory of 4304	1860	msedge.exe	89
PID 1860 wrote to memory of 4304	1860	msedge.exe	89
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90
PID 1860 wrote to memory of 3836	1860	msedge.exe	90

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://http://b9e62ce10d663d3d1a9111ad6e186af024320d2af46879e20ff3d3508de30a5a
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc201b46f8,0x7ffc201b4708,0x7ffc201b4718
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff709cf5460,0x7ff709cf5470,0x7ff709cf5480
    3⤵
    PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7947668073564714007,10818832837083961851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8e068076538743d62dbebbbf7d7e2499

SHA1
12c776b76f9aafee6e1e3acb8f17c397d92dea92

SHA256
f14a4d84df6dc971f79343a4beab6944f2e84c1b86f02ed3ef3b92fd201c0e71

SHA512
f59481e8381089246c347229e95046a80d546bcfcd7f47e8dda630aad363265516b5ed006f4fc7d2d1a7bae3ff4f8cae5f081396f791c8a3b5c073ac3d3b6526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
81b8291c478bf63e10be1e365da794e0

SHA1
d66dddfed7b7d9679ea4868f8f59a99a9c9662d2

SHA256
f726a0f21b204a8e363bf9b7fc9126116a457bb1632f3b9da04e4bd9088101c4

SHA512
c8610c6210db19245bd2b80aa41f69e4ce8ce6c223baa2f1e52a7f0309df5ca2a5572f7ab5b9b25fedc61257c6c26b2a33b72208dcf54d8dc75f84120e9df926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
45KB

MD5
311447ef344aaf18a9f685d90a2cf0af

SHA1
5b396f009ba488f3748017dae1dc9a3b6b39039e

SHA256
c5d43b36d8d96dbde39b1b8da88f3cfce3c3de84ab0046626f2636d02f30175a

SHA512
d6276d3b7408fead3ada25651b4df70e605adcc2ab07112b3b705ccce4c5e317ab52edc898180c092f8a50532bc9e3a7744fd80f9f1a3d53be291bfbbb2995de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
17KB

MD5
62a707260fc6c8d9cee535fbd161fe05

SHA1
2d21e1d7800ae2ab8b0bc00ee538383c799fb16d

SHA256
10522ea2b9e5d5a60b3e0a210ef64580d5e8b3d5e4a19376d01698d5cf214f41

SHA512
acfb5de939bbab077c78c43bf5ff64f1ad5cf9d06eb30838f7d606c97b10253c82de3dbc6bccfdc91823e1a6b4b82ef84b8827135715553d4c6e95500c48f2c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
80KB

MD5
f90a679b84220fa4749d170c42b0e4a3

SHA1
bd68e049d57eec41cf763fb600bc3bc6f3628594

SHA256
3d7be48b6a6503e7e6bfe17af0aae485b12a0482633c6c285b17ba21c2991a89

SHA512
9416ffd5ecd136c9d16b73c8a7605e01cbd1ee91d107e279bdb112c447072fd4ab0df699f078cc7facbfd59a2922ccf405c92b66b61f297f6be9ee2bc24f10ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
60KB

MD5
7864630dae310abe9111b8d4e9ff466a

SHA1
86c3c24decdec45a3297bfb2f311b209d87361a3

SHA256
3e7a2e3c134112754033d01101013b25ee468f291693d088f8f0ef7765c2fb8e

SHA512
ec57b91583970aa2210aee94fcd0539cb62e6163096a969679d722bdffa94cc2a5218c8e05fd5f264e2dc393caa5de237bfa624a32532d01fb5f314c1ab976ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
16KB

MD5
48c80c7c28b5b00a8b4ff94a22b72fe3

SHA1
d57303c2ad2fd5cedc5cb20f264a6965a7819cee

SHA256
6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356

SHA512
c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
20KB

MD5
39307e27138b106e53f1a4af27d63094

SHA1
9c2fbfb3f19bf72a282a101d1c802c287dbb5fab

SHA256
07c09b206faa8934e6b12c518a4f834d8bd5b2bbe92a07a4f169173ab620b464

SHA512
8e48c468cceab8dfb296c62c2fcf4e82adde92fc06e3b14418a4cc08dea5712aaa7f61eb5421b9d5fbc0803b1b8f2b05a344a2e3db7831212af9e2579972bc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
29KB

MD5
f85e85276ba5f87111add53684ec3fcb

SHA1
ecaf9aa3c5dd50eca0b83f1fb9effad801336441

SHA256
4b0beec41cb9785652a4a3172a4badbdaa200b5e0b17a7bcc81af25afd9b2432

SHA512
1915a2d4218ee2dbb73c490b1acac722a35f7864b7d488a791c96a16889cd86eee965174b59498295b3491a9783facce5660d719133e9c5fb3b96df47dde7a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

Filesize
85KB

MD5
0cbdce94d58f924fd8250343afc3d0a4

SHA1
95ff8e723e8758fb05d7e8c52a5fbb595a447fbd

SHA256
af29ee1f2f574e030e5bfae8cfc4fdc57dbef85ae59be60d02bc035bd7493a0b

SHA512
332171c632d6e5a424e980a605b05f01a4a56c2e3ba8656f4897bfc6f657c9cd5e7fc03b1f53ff2e308abd2234199659837f13dcce3bd8a9cd3bfd2db88f7bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c9

Filesize
18KB

MD5
52315b774c5afe4deee9348b6171c35d

SHA1
068f9323ac0b7166dc2b281b6d526a294c3634da

SHA256
9e2ad51e8f68c81d9a8cf90b272517650b11d54ce59117cf885f82949db34aab

SHA512
45466fbf08af344b2b92857a10f5f06657e0dd3c8d0ad600fc9d824ed71039843dbc20a082f38e40940f37c50f6eb9e92a4f0e39ac4f068dae30736c775ff4a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000db

Filesize
114KB

MD5
643d42c9359f9cf6ba17390de496c20b

SHA1
febff218e214ee5b549fe9a1cd938fe289cb0774

SHA256
98542c9e1a0be6d4800731c5a4c9150e8a3c314d70db83eaa331d60db8571f09

SHA512
2692ed1db6a83cd1beb57a67193ddc21331e194af87b39af78fbeb169dd4289434f828d510d4448d647b7d1d4b249d49c8a196fb71f8545bb469622ab7fd74da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
56c4b6fefea51dc420f3f4d0f0a95759

SHA1
50ded11875a307986dcb56293bc21d8724640e05

SHA256
3957605233776afd3ec8f4fc178fb988ea66f4519f2b643c54092b2590c74d49

SHA512
e891facb231c333cf66b49f88f6ce2f35f3bb52ffff1b2230686d9a4cb382ab3de2b120efda932a089d3d23dcb4789574d8f669bd4f6265dfa76ec75a4f9fd12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
efd3c71578b137abb89385db019ca350

SHA1
9366556df14208a15581803f3fbd390a954835b6

SHA256
e7ef655880b164f7a198b91460da55557ae2cd0879ee212a10ebae52af039292

SHA512
e2c175626f06ff6d3ea901f8a5e4c2c6fb5f3b84425745d984441a28236741376de7dcb1b0dcec9451dba2d46b8ee1fd900f60a14490f9d3713c7b492fffa2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
2f4edbfc9663e4fa23bc3cf85079bb4a

SHA1
d1f5c0ee667f2cad4592fd02498630bdd5798ac9

SHA256
3718e833ef71644a8a36c394f6e93eca8f7a32f251800041742fc9f64ad5d417

SHA512
aa4523494f29950320303b1997e4e548f63a2e65a70feead7c2594eaa705505bc39115ab07ca4bc7e052e1d5ed77a419da5f36755889e76ec2453c3affacd726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
a036f490da2f5156981f5e12d2d7ec27

SHA1
d75878ae8156849c244272cde9b1ec2c9fd1b43e

SHA256
a0debfd833b1cb2f1195d8153789859ad5d33ce142e769a8ccaf5f982ec6a4e4

SHA512
a21555972a5cd5c238494cea341661ed6bf93aa38e3847eb8fbedc9ca11278c688a20f75fdc02f78e7aa451667acb869e056724f6925cbeec7e583d015498a66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3b2d4ee625988dbbaeb9324749f24456

SHA1
46bf6bfec79f51cf56670f4f90124dfa234d29d3

SHA256
6b0fbbef29b58fae9d288de635a0037d42e218c7cacfbd524a6816291c0f439d

SHA512
2ba8193aba9a45b7bddefc7fb4c7874d741b0a8a6b41d185f037edb9896a51930e711266c586c7aefba55b6b003707f9b34277c123324cd119c95687a850587f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a512aa75d91a8033f68f1688935f917c

SHA1
ab4115d5d5d758a79728d6dfe68debab15505215

SHA256
9543925d73cbcf815af5fc1a7639f702868b1c2c1a4374e4c27c88c90c7a990a

SHA512
158dd3497d70c64aa642ea2ec6bcc525a42d5e707247ce909543967f58f390008798ac5511c3cb5d4d69c35829bbe8ba47996ef830ea864998e60be514a6d3b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39902bae27843a815b99f9582dcc28ab

SHA1
edc5d6782d1d84598e013aff94a5c0d2b4ebb7f5

SHA256
0f58d7014cab237393b8526bc0605d8f7081db9d9983c450e0f921b6c13cd932

SHA512
1f3cc6cf56d537d9f2904079dbea691edaf5268b0c64100fa5e2da660342682391cab74cb6fda832c6c095c7273e68de5b2ab2ec2824e4e2fe63dd99d77f3235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8540363b2b8abeae9a5c8568262fad25

SHA1
fca7c1b74e85d69f452fb7c7a649bd5743834228

SHA256
8ebaf0630cd4f1d4b3b28763fa4b8e1082c7c6f24245d68343210e5b54f07f48

SHA512
5029bcc6965f9dd85ed4edeae72a6f75151bf3c07d74ce2716815f2035fb0acd31df91b30ddd6c0e543a3195488b33694890c490490389cb70f74668fd3326ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9d9bd6cd514791a2092c3f1caf3507e7

SHA1
e43054ca6f6a99d2e2689b74ee764c06029cd91a

SHA256
9508a7d9c01076d8a4cb82fa6c9dac7e45ff332c539fee5f5498e71742e3fceb

SHA512
f3538f6b6327e0730b8a26b9f791827c720b96e190569198ba62a2a6aa916eba7432849c4e0101b76d26683db063e1820b7d2857a80dc4c3781091b54bb90213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
c426429508c6ad1f554a4681d00c3cc4

SHA1
422dd0040f95b14d2a67a25a1851d29e47fc1660

SHA256
7aadca823ec9fe5e1213dab1b21ce9c670ed7dc3ad667e8c56b7ab4261c7676e

SHA512
dc6d47dac2ad5f220b89c2b58e2ea392825b7c1509339095547fcb6b15f3a8f6fe28f51ba34a73f8564864783d92e738c0aefaf6a8733a7b8da0eb3e43d2270d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
73ba0c11bd3d6b0f1738117c40c23cb3

SHA1
e5fcc4bd73486fb0699d55762beac27f742260bd

SHA256
902e35f0895392726473e1f951a81c80ee1cce8b4efa737a459897daf6ffb1a6

SHA512
67b614687ba6462e4ca4825686ffa1dbd1740c98e61f92794b78882f2f742a998aa1bdd893f7287b17975488191408dd041b5d08d6870d5373e26b1852be5037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
77c20374372d6c522d4baa478c787960

SHA1
a929837ece4ce34c9c549d0dfdfd6a98e7cad2c9

SHA256
99cd4b23243242e2f0aa92bddb6d9b4f64d810b120d5bb991b0edeaf3c4182a9

SHA512
93072a217d4d4a2ddd7cab6b21e244d1095d417692b412484888a6ca51b775de37611bb2c6655fd6f6380ac4f39a0fc4acf58d1cae4d259300c93ded821c7bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
69b72d0a4a2f9cbec95b3201ca02ae2f

SHA1
fcc44ae63c9b0280a10408551a41843f8de72b21

SHA256
996c85ab362c1d17a2a6992e03fdc8a0c0372f81f8fad93970823519973c7b9c

SHA512
08d70d28f1e8d9e539a2c0fbac667a8447ea85ea7b08679139abbbbb1b6250d944468b128ed6b386782f41ca03020e3a82491acb1fe101b09635d606b1a298be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
2KB

MD5
89d6aa542d90a430d2bc7907b20ffed6

SHA1
b5ff33e80f97afe2e8f3a2937116f2a61b3d8544

SHA256
a13abb1d95ac1339d6db17a625b3bc203cc35f374b1edb8fa6498ba6ca46967f

SHA512
cadd781197322a06ae38418f84219820cf6b441e3990bfc081febe07fd6aa595f9023d61e906507eb3539ca27c63d4ecdd3b16bba7833c0c9eac7edc827d6fe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
b71b3a46f4e74e126e1a44955e3a6a20

SHA1
a86cf0deed6f98150dcf47f08f8f2e8249f085cf

SHA256
3eaf5a3248416ee4a11934cffa4ac6bcbe829f2b2e2f436a74c781dacf203b78

SHA512
78a99ee7ce24a1c73c7b4dade85a827593fc8b5f592c2c595ee88b4d65255456fffa94deaa95e1fbce07f69cd21c985ff98c62c4686cd752f260b42c04e0679c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe578637.TMP

Filesize
48B

MD5
d958f5df50c30d117afbbe5c46185d56

SHA1
3a013c13e82823eff9dfc0a0a3495b12d0b3c043

SHA256
6307218a39e7f276c132b667ae42d776f15f9f7ee67a540dda16dd502b603973

SHA512
996f91acc3dfff44e82a5583ea00f6ddedf45f16bca6002b68ee06a75bffd8b369cef68a94149e5fb246bbbca5efb625d8fe0f7b25b79211f84b749737f60ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
afecb92d60a695681f20d9ebed1d0a35

SHA1
7e0496f1bf965d5f2490a0bc6f0cebfd2e6988a6

SHA256
fd24ba6cac113365cad54acbc1416b03cba372ba89b0176567b3eff92ce59126

SHA512
87df1af636e6b964651e69a1699dcb95445577668259eb5b899261b4c9bec05709e2c0e665e18c4e78d0a149fd10da8d5dc7e267f9dd2f410a959fefda06bd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b57eff897a89f020a50cfda34d572905

SHA1
167681405c51bed22c2e02afd411dd629445e092

SHA256
05b18413cf9fb8fd1959579b48b398f458e14006fdb22170376195c568f021d4

SHA512
7c5b55cd0b41002b6608da77105d0e95aa159d76843708490cb7e8b49187a1d7093ae4d7c4017df7100e984ba080a10f96e2e01874329d32b9a0592b9cfaf756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9bbca37825555b7d402de38cf45f7c2a

SHA1
c044ee37405d50021ee8d72f971f13162dfde325

SHA256
a3101fe2e1366cb9e3340232fc3401ca655532e0f64941b883464b37712046f8

SHA512
6a7ef35aa0859b259b62c4cb6eeb96165cc903696a550ab870c1eb4146f255671618a083f57b5ae02246bd407ee0580c4db8c4e612a1ae31d49e4e56f12ea51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3395ce36c3987107767e5044bd70330c

SHA1
6b9a348701143d86638dabb42202c565097fccbc

SHA256
c9f302eebd6055774dab609137e7814e7e265abece8aa79044ae550691163e48

SHA512
ab67453e3322eb3638a438d788c204f0087e4e07ba3942336c90353b4f4b0f154f28fe9f17f7293aea1159ded4ef411d85bc4c936adbcc3a52b205121bdff422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe577203.TMP

Filesize
1KB

MD5
3dd3005a73849ea185e5639a3c508440

SHA1
c172e063c6e0b7f3276bad5cac369c1eed4edef9

SHA256
082f6ec374123153efd3a8989ff66d17cfb31e4f0b6a7ef68a66743bcf5bb6c1

SHA512
429a1bc0ad39e985166465a5426a96b229001066e14f20276c63ad54c8f325a422bd30c492950353770db6d9557581b99799a34937fdacb97feaea461b8b1349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
16f54b8ddcbeb518530fed0961431e4d

SHA1
9cce49ca64edfd8ea09d986ffd10aabc4cdb0399

SHA256
ace1ea35c84f94ba79ae981c6c159e30f8d0c74cc216f67d81fa95a4a44327f7

SHA512
e69e818390cf97b283d4613385d4188be815397fef379430754ab497fc757722f62d61f666348ffabc579416edd7e21abfba5af1c711e448508881c6366efe8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c9191a4f14767012afa9c2cf23ecfa70

SHA1
64e2fe433364faa12e96c93175e589364fe3f4fa

SHA256
b4a655e1dcf4fa1fae59d85e4e93079c9e58197b9007687482adf0c163728d94

SHA512
ddddc92176c079224f56343c7858946d56c97521419270e9c6ca2a27c65532d7c124394c65b9124ef2468cb040c60206e3e98a2bb1aea40c4391240a079741df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b7e9f270f594659e2a4b131b153e56d8

SHA1
8d54e9bdb4d6f8cf4aa381181313c185acd48ad4

SHA256
a186562256da85496889bb0b5108f2f18abc5d5bac4defdcee1ed55863bbff0a

SHA512
2225f51379f0ef8136b540e74ad159d8f91d687dcaa612f7c1881000d4e7e205bbd40a1cb3a79f7fe27133d5e51859603542d1e77291a68df13802dc8f779463

Download Submit