hxxps://onedrive[.]live[.]com/?authkey=%21AJPmpUHIB6ZAgrE&id=75D73334984B32AC%21158&cid=75D73334984B32AC&parId=root&parQt=sharedby&o=OneUp

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://onedrive.live.com/?authkey=%21AJPmpUHIB6ZAgrE&id=75D73334984B32AC%21158&cid=75D73334984B32AC&parId=root&parQt=sharedby&o=OneUp

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\206e7bfe-a582-42d6-aae9-5a5c1b381ee0.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230605165200.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 60 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cbc20cce97d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\live.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "85"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "85"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "322"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1025b40cce97d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "184657693"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "322"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392748861"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "19"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "117"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31037390"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "19"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "117"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "164548321"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "164558267"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "117"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000af1ff0a4e0b4484c83f365b60ddc704400000000020000000000106600000001000020000000bf0fba9919f6cdde01f9a1cb17e0f16a910763ac69c9e5b8456c53ebacc5d81f000000000e80000000020000200000003266171214e8fa21a7ee384a4c0b63697a7783419efdac72c3482a0375519806200000003c57d1892e3174e24e1c3aa217072d7236eecbdc8bed4318fd53c2a817016a9a40000000c8fd7c9a92633e9969edd90752979861a14041df5ba7b8d8205683e1f11cd75651644c0f44ff56d29f95f789b049a51c96ce93e9b233acdc099974fe0ec21464	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "19"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\onedrive.live.com\ = "322"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "85"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31037390"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000af1ff0a4e0b4484c83f365b60ddc704400000000020000000000106600000001000020000000e1663194e2a72642ee1cc44b2d152e9ac18f439b04d555267c596faeab8e27d4000000000e8000000002000020000000bde2aa7cda4894a68a1958b5573c9faff505f097ae7ce17deabd56ca61d40e7b20000000994825a9566b69067b3eda9df76a2982ebdee969bce0d8b5f9d8044ab44e9e4940000000a1f0587e5533498539c7a4b5c4d818f36fdc447236fece51b97adc2659820a7c600eb8f0fc5a8e054fab29ad02ac480595347e59e2f748cd094414f7d6c0430f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{35077C06-03C1-11EE-ABF7-DE61172DF127} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31037390"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
2180	msedge.exe
2180	msedge.exe
5736	identity_helper.exe
5736	identity_helper.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1840	iexplore.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1840	iexplore.exe
1840	iexplore.exe
4740	IEXPLORE.EXE
4740	IEXPLORE.EXE
4740	IEXPLORE.EXE
4740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4740	1840	iexplore.exe	85
PID 1840 wrote to memory of 4740	1840	iexplore.exe	85
PID 1840 wrote to memory of 4740	1840	iexplore.exe	85
PID 2180 wrote to memory of 1484	2180	msedge.exe	100
PID 2180 wrote to memory of 1484	2180	msedge.exe	100
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 1536	2180	msedge.exe	101
PID 2180 wrote to memory of 4032	2180	msedge.exe	102
PID 2180 wrote to memory of 4032	2180	msedge.exe	102
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103
PID 2180 wrote to memory of 3484	2180	msedge.exe	103

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://onedrive.live.com/?authkey=%21AJPmpUHIB6ZAgrE&id=75D73334984B32AC%21158&cid=75D73334984B32AC&parId=root&parQt=sharedby&o=OneUp
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe2ef446f8,0x7ffe2ef44708,0x7ffe2ef44718
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff667b35460,0x7ff667b35470,0x7ff667b35480
    3⤵
    PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14181703614432434293,6863936911272805891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
1KB

MD5
6eeb1e3e90fd207352c6749736ece4b0

SHA1
5a115a774b34c7c5aba28c3c0202a212575b1a0c

SHA256
745d0a8fd4a7b00c2cc79ead9d2ccd7c915facb890cc7a03505265a8ad3774ad

SHA512
4e2027582cf90faf1db603fa69d9b4db85aa21d61b1ed0f9930eee934c38db8b1eb57dd9c5e634449a7d320c0dfeac58a2709ae39ad9d22dbc4582f8f5089abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
6776a455f2fbdb44133158e334a7de52

SHA1
1541ec3ec2ca8ca3a5b20bb69e2679e039729335

SHA256
c6dfc43ed1702124201722fb4f06d6d394c9e6ac34f371a6d186e409fa7b4e07

SHA512
fdcad566b8d11ec78e395d0593c3525070e420191ee332e0ab348c3f584a01c9bd10ea8c9bf727cb0a8e2e7b4acae51e28e024bae72d66b50a9e1cce1b1dfb45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
ae05b1bb970c452c57f711bbcc26fbfe

SHA1
4c4a83bc4da91be5fdc57dd168b0320eb3a7bf6d

SHA256
3018b2e000ef679320714fcb2e965e15e184380f595663b6952a1945b33b2793

SHA512
7e79f23adbbf5694db49f6646b9c027e911726ddfe65a146497561ac676d187d3a70c19d3cb111592d2019dc651f84a07cddb7fae025eba1888aa8b63f82e59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868

Filesize
471B

MD5
4ced394dd9473b02c04a5932ec35fa3e

SHA1
ab49d110930242b279b2ff67f9275ca87b845a5a

SHA256
b1ca4bbc5dbd9e9ca8f2374c19a75c7d177353a892106b40542003fec4dbc1df

SHA512
efa33e50d6f8dc012950783936121f21b8cd4a11224c1969f23d279d7242704a67921c89b1a2be054d8e233d501b9fe099163210788bb638a43bdb3b97d3c919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
471B

MD5
79cff30f49358c232bb3c9cc37486d02

SHA1
76102925dacfa67acacb9362a7a71d497e9ba5ec

SHA256
8b87425ec96ea24b0bc3fc816e9e7fbcbdbe0a1e2484186eef1015a463073705

SHA512
1540d8a6c99d0b2ce974b803a6c322936d8e34b1be7e2dc7e6c1d2bc8bfbf146ab57f54f219a7cf4fc6f85a7649ad4c9f29975c39038267f3003df79ac9add71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA05FCB97DD0D7E021F4604D281F94B8_35112AB6E4F2DEB9C2535570821BD25A

Filesize
971B

MD5
b7c850c45aeb284131e29276ca0a8741

SHA1
fbd0fef8dfb1b20af47664b5c3dbeaa5a05aba6a

SHA256
58cf9fb154343af5aa73d17cc212022fe627e4e1f0c8850d3dcd1d9233a2a128

SHA512
5235c96257e4a991d1ba8d11f0d64bececd970c694bb145cd0e98bc9dddc784fd380fffea3235a67bcf6165c8826ee0746254806b9cdb2fd89f69bab1b0b2b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A

Filesize
313B

MD5
02cf5fe2e9caf7000de01e407e7df1f1

SHA1
c4f2762ae858c8081124f1b5bd182760da1c398b

SHA256
6361ae94782be6fd2ae179feaad1a7d7dd4859a095d29cb37510bcfdaff10a5c

SHA512
50c64288c40776b457609300b2ea478dc0fea2ec0f17a1262f0444f8c351c8ca9c7a29f5fd4f734c4c60845a5d57645ca79cfe01255a64fab414b9b4593dfb4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
416B

MD5
f4d5369c0f28101299ec44fdc335e2e2

SHA1
ead3e5c585d1d30d8c8901e19780d415da167898

SHA256
47be4c662a4688526270e64ad1a2e593bd69af896c9823cac916b7574626f9d8

SHA512
65a98dd5dce1dcba313f486851ed24e604df615572a1bb598577fb2cf1bf09112f28f47ed9e3a9b154e8291ede669b4ae8f6c0907baf0fd6d2ee4462327d46ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
2c76903b7afe3f99cb9eadbb4f42ce74

SHA1
4ab3a0149b59eee32ed01d6cd956a1cce8623bc2

SHA256
65c0cbdbda6f082939985b249af9f364366b9573ea1645f0afcbdb686e853b01

SHA512
1484b2fbea0d4cfb0106e831a9f1d9068426a16e46d9983fd97aaa7f75d860856bcacbb9e6b945f38da3bd2cdd97028db265ffda0ada2ba8a45971a215c61db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
412B

MD5
776032ea905a2705870787956f867643

SHA1
08d764a040f25ecfd221ce9f1349ce0b1472272e

SHA256
5f062bb1a51ed18477acf28af8436046674db0c1ceb9cb85724e4813ab18b33f

SHA512
641bb6bd5d36c93fd18cfe93def6257b6b1a05a10f361a4c32148ec1054ae9f410b917e58a94fecf9b6ee3c48756bf29e7a954362b283247f11b816e1e9b31fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868

Filesize
412B

MD5
5751d1e0178cf307fb9bf47178441cb6

SHA1
216b828394c831bd4f4b15bb210eb6200bf0c7e7

SHA256
ac73579272753b591da19c7d11b77a5cb8975eab2b851dcf786ae9021ede80aa

SHA512
9b0da2e883ebfac7775192c38a85ed31c30d7f15cca1c77819520c9556db20b17afaba46adbdc2ac50192b181a9177f4697231eace00c37a9b247c491a11d53a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
412B

MD5
927ef97b45983c5860e3fd7136467a59

SHA1
99f4672b6135994c33e3616fc304b1538b5178bd

SHA256
ce058cf4fd2ce82578e68bdbd915b3f6d09c5ca8f032bd4873b9e52666722fd9

SHA512
025492cc497a5d60a166e8a149dd584e39b4df62860f46719f7756561e0b8e4d547650c45b38851f75acdcbaed5427bc57061b5745ce619826fea7a85318d6aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA05FCB97DD0D7E021F4604D281F94B8_35112AB6E4F2DEB9C2535570821BD25A

Filesize
564B

MD5
8908aaf9b4a7004a81072dc5eb859bd6

SHA1
c6ae9e235beffab5ac8bf523c5cf44fe7b1d34a0

SHA256
a844ed653183ac99d7ad273d550994b786f1206c41329d8ee70c2027b83e81ed

SHA512
ec5ed1eea876f34a6402aa87c11aac26d838898c5121fa33d474995c073bf704e9248b3d1a58f838ad4e642299852e4722c1b2c278bb4c980acebc0286c64a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A

Filesize
404B

MD5
7f3e5c82fa1720e96789b8544b3235c3

SHA1
e24e6c47176222b75b48a524f644283f26a51013

SHA256
6a7aa0a3c3d6ba9fc601e9042c7bfa966ba70c5e4838f6e4a5e702b6f2bc18e3

SHA512
d22e6249d81e1302db24b2418e422b9bee1e32162e1cbbde314fb2062ae4146c54ad4649d4da0239e41e91422db80378f70f0a9ad095e08b0929a06b9cb08f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
fe75a961aa0e11b4913ce2f9ea905c2c

SHA1
6974a7231eafb50149afe4ce4d87cac1fdef79f4

SHA256
55a54c5d7f0181c555dbadaf890a814a8788272d1f0488eebc06765f2fecfeb8

SHA512
44cbeed557bf072a9bc5556259160ae49aea1f9a9cc6ca611c5c9521d7843996b1dd764325e7953a2bb0d6d6e0ce3b9ba424a63f46eba3871ccf824c455f2804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
84bff7c5660860cb145a6381a6b4db63

SHA1
f5bba7c282988601918dac8d23f174c596be5a9f

SHA256
662b452c6ac695b26bb34de3e9c83f301070afec757ebdb086cfe87cd9f93b93

SHA512
4b0bd0175a72db9cb6a17228596fb668eeee97a33c8439e81fd537f162e8013c17b9d6aba6ec7af2b1c1e7c39874bf3209cce1d907aa11a75ffe275c6748716a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
72fdf204739473203bf6e32465680f56

SHA1
ebb01f6fbad2ceeaa7d3e31cf132711215690e2e

SHA256
d88f5423b60f2fe5ee36b8aa6206adf56a80ab6624d30ee416da1b3e6c06d960

SHA512
5db5d07900ad80d8cf8c041f33f6a275ff8b12fc630960ef32931365dd03ff2ff2b2462317ca6685b9415a33bfcbb00c804260763a903dc20529673aad8042ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
811B

MD5
07b3129c1f162db4a64549e6404b6621

SHA1
88065fdd21c4df91776fc57fb0d3cd4a99c10a11

SHA256
6166758200b0ef497dad8e2a6f8a85351e3ebe4bdded540c4599da0bf5c93e5b

SHA512
a52fcb5a0a4a2f6839d70f7421578239a15980258b5566618757edb3c921c0affae8f4f24d7fd045235508c285983a4b3d821fb2293363b8580db47faf204a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
98e09250a4c3bdf159606e954a424f0c

SHA1
8d49c9752e81029afd347f59e93e94aaf5fee311

SHA256
2dfce4ee4a35c0a1348be58e104c0856871f0a71084ffcdab83b84947d670297

SHA512
d57ee9318fb67d68fb2a9268c1c998725d5059cac0fe6f8e83afc88443fbeab1947bfc896fde33906155d689b51f8d3495fd3af634e6ff1e8fca658584bc6a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68804758b21493b28b833fc40236a7ba

SHA1
e89ce6f3bf2b8f5c3e204932a64581c688765497

SHA256
3bcfee75bdc2cdf5423774f539834e0727e242c50d1b84c97c0c700be90a3004

SHA512
14d445c398e9117f79129cbc9427c1004a09f9065227111ed5cd643e2bbb0b6623bbb8cabfa237829dcfe49c32dadb8c813b70732cfa7406b9ea5dec6ea26d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e78fa8433fd2b38af4da1a41d88ea2de

SHA1
37ca6c488c40c1edef9ebb0f6e38ee1f82b647c8

SHA256
6b3236da586b64652578cadeeabe4f4acab7661881f8e81b68225560e5fbb446

SHA512
acab782296c4b597e0427d7d514e7e381ba443c1de20ea51c588bef0b2c28b7ff4cf6276b1e776717d362e0dafb3f88bff2b21e297d55f6d2c19ff7e6de5873c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
447c8bccc8fe0bc4788135510815e42e

SHA1
5c6df766b49b39b411170373d599bd09ae76b92d

SHA256
45169e5f516edae30dd40decd78abaedf7b758e3331468ccc58c40e6e749c02f

SHA512
178b2d886816bdb89244778fc9d088c6451dcce29964278fa1a3de873f88c1b70224bfe17be613482defb25941a65d72d8aa5572d2fc3b8ef98cca05f558e0d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc5f988722f72244e9a4aa8e1d6a0ee2

SHA1
4a132601b1d75fe013d364df95b711223eb9f742

SHA256
8ae99505d61450350ed2799d1bcca3cf9bcd4dd2e6a99cfcfcb2e929704592d9

SHA512
be7c42520bfe8aa8a966881190240bfef15471e84c4dad78ee3c3c0adc14d02e24f6eb950a68914d5870d51c4e91e42cb91eaedc69c360cb9cdc70c40d0cea2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
712fe2eadf19faa624035d1f9421a0c7

SHA1
2f479350e54c9d42a88f8f5aa159726522080847

SHA256
88f879005c5f3af4a8b0ab808376af093734105eb9f95c64acba00a09755e74f

SHA512
d06ffd0e3ad4724dab33019a8b51a23484a98eb9f2cc3226568bbd03a612ebb077d34103344595b95d5c02153a0a739938115234fa623f9d8b29990522e76211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe574edb.TMP

Filesize
48B

MD5
5ec9116671444faaae05b2833fd22e65

SHA1
2954266a2a1c2cbe6cb59191bca4d10713b1db61

SHA256
2e8044e1408eda79bd278f2ce13552866cdd158ba431c9a55539165f15652892

SHA512
8daf2f9e5fe5fbdca29d9d71f9a0e58f3415a7b0f52c5023a0eef94fd89a57bfd8814148f74350bee6839dc5fa47759fe2a5adfa13aef16a11bb89e66a8eea36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d19286058ff497a25e4bf2575a585a83

SHA1
0e73c948a9ff57898976e3b95a0b60efd570fa3c

SHA256
96fc1b13cdec047c8c0e24b66072a2471781da249a93ce5f57ba26c8998b686c

SHA512
87950d92b251d860066ed2ffc0e4cb508a5102241305bcab77bf08ef1da268e04c826c9ecedccf8ec979b14b9424212d980175977a4fa03e31643b645f6539a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579df5.TMP

Filesize
1KB

MD5
bf8738ea63f69d138a25aca1518791b4

SHA1
0d983368eb3b17b4a006105abc2687af159bbd36

SHA256
1053992fdfd49d184c015c43ab8d4848d31c4e6cb8f2a76b3ea8fa6fd1aa3896

SHA512
ca086d57fd3e346b8291199112e569cca3415abdbe097e2547150a27f38a3107af2d78302cf88044dcf57a796eb49d587fd85136f248e71be4655e1e67616ca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
f46016c81cdc59c3168fd535ecb0dcac

SHA1
b5a1a7cd208c10ad29b7640508ebbd64820b7fda

SHA256
751a91a1ff375490f6cda913c72c333a6d58db170d2efd077e9e0364229cca39

SHA512
4d372995e785664e100b01b54ac024e69d2c6442c582761b3dfb46e15f57142e8e845c0b7c93efa8eaea6314e9f774096b0a88ab45726c679f69e9d493bff88e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ce8aa680b63221489c336521521a9395

SHA1
e9f9aff1bb2741db9089b633399456081a7aaaf8

SHA256
81dc43ae98c664db68a272caadb0067c4bef3e8c5db0fb19873a14153d75c9a2

SHA512
acebbdd11a3e665ccd5bd053407b004827f42bfed74935d63c46b4bcd60d577fa234af67f0fa6ce8de0f2ec907b54261a69f2f07ea369be800f430c32bcfe5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
13e66d07e5c384f90be2258a52341750

SHA1
8edd79725cf9483fce2cb7f24bb68305d40f0fae

SHA256
fcedb65e6215cd54ad3e5437161f0f7c5434c9f85d8722bcc3bdc1c85eedb63c

SHA512
1de7b93e8c43e859fc4bd7d640eadd2f0284035b1b8d2e349d0783ed275c93ab923132e240a04220ead4f0b89e2127a830d7e3fe5be3edd2ada6564b75160f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HB4E59HA\onedrive.live[1].xml

Filesize
636B

MD5
931105d7d9907849a7e197ed6049831a

SHA1
d7582055a4c3617e5595be32c29e551a624add87

SHA256
346aac67fb7328b5238841b42a1ea9d77528779f3f0df8f5854d1825214618a6

SHA512
d819a7339034aba39cdb4781675815a7d9871cc3c6b49cbaba089ad56aab931765840243bc8a9590ad4a0fd56ae0ca811e8a64dcf1099ba659c836f033dfb8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

Filesize
8KB

MD5
ad9eb2a8b6a946f47fd797d16d2328de

SHA1
1bdc7344c6d94e9fde08599fb588bc75acad647f

SHA256
c5e752321b9d5faad93adb471bcbe231b6788ca98bd1a618e420081078ed0813

SHA512
e1a1659372795924d5bf25cb45c496489da32459adb4c2ed40d333b12e29597582b9dd962be1d7ac54d1dd8fbbb7521d9438fa1e56d20dcc87807d172693c0e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\onedrive-font-face-definitions[1].css

Filesize
14KB

MD5
fe46325bf6167047462e10177c5d208f

SHA1
b54445bccc3f97503835d374a8beede48759723d

SHA256
e46a8f98bdf831bbdca0057cd9f046e6454c85478bde2202a8faee6bdbf7b683

SHA512
48abc256d7afe259a19624518f7c18def32759886ccc94fa41d02debd2729171eca2b2621a4de0b58351d19fdad33c6d2ca2fb91eb03a1710478143ac76d3f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\favicon[1].ico

Filesize
7KB

MD5
604adfb53677b5ca4f910ffb131b3e7c

SHA1
5f1a0fb4e4ad3707e591ce16352158263488ed70

SHA256
24638331466a52bb66f912090e7a9cc9e3df2236e39c187c9409104526b472b0

SHA512
35f618f42adfee6d1335c67f729c298789419fe2930371a91683f60481794488dfaf15b572e6fc1be70833ef12dfe57432725f6336b6b73dcfb52596f57f30a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1fc6da74debc01f84b198eee95376cc3

SHA1
c1bf60d23b418a9cd15741ce84ee60f60e93a870

SHA256
de1576a6196cd8d85eae65eaf27c73cb3f3285f529160748f74989c790290236

SHA512
0eb34b91a2e27544849abd0c4a24e441a116d227d1d938a0ac69fa7e8cbf6adfd726117be655a50c565fda1d7c098b32e8e8923b5db683f2e0558a1df3573b28

Download Submit