hxxp:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on

max time kernel
672s
max time network
671s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2023 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1873812795-1433807462-1429862679-1000\{4EC671AD-406E-4F49-A4F4-A03F4D315E65}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
3328	msedge.exe
3328	msedge.exe
1616	identity_helper.exe
1616	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4696	3328	msedge.exe	83
PID 3328 wrote to memory of 4696	3328	msedge.exe	83
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 1968	3328	msedge.exe	84
PID 3328 wrote to memory of 4648	3328	msedge.exe	85
PID 3328 wrote to memory of 4648	3328	msedge.exe	85
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86
PID 3328 wrote to memory of 3620	3328	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0d9a46f8,0x7fff0d9a4708,0x7fff0d9a4718
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8921413126502268813,17166322611512549387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:3472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\023b2a5f-7c83-4a47-bb01-60444ea7b292.tmp

Filesize
7KB

MD5
484bd7bb4ee806eb13d6258d45299694

SHA1
570970c758db200d3eea3ecfa0cb9575df47d846

SHA256
b7da30bd93ee1852c4a25ab0639d8091824db924dbdaadb6601e3891fe89dee3

SHA512
09c66111b82ad986e81e01499c0d3faf3018a3d6bdd0879f7b7a5ee9fa0cfdc81b04a8371ac3d5779b225635cfb684bee600f907bbec287fa60adb26c1d3d53b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
b0860d99ed0ff20efc4742695b4cadcf

SHA1
f51d66601a74654e72dd74b327552844528a412d

SHA256
301f265c2cececdef015fb94497bddc524d8cdec88e2d4eacd50ce55b9b972e3

SHA512
de4e0f2677ca0dc230d2530fd954ac91733b354ea042021c584021f746bdc6af09467f960589a206edb8bbaa7870a4b4e17eaa92dd7d4bfc65fa17a67cba5331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c99ca14cf49f72375ee740bb52d25488

SHA1
fb9b18a7d3d1dea0bc94812e194e2765157d3aba

SHA256
09c0720e10ce53a9c870c06703dd15d111f6aad26b9320d5897fb18ac948862e

SHA512
d672321c85a83b25fe41d184bb1107e6b5f620313bfd71e10c6cd6e5ee5ee09853d983e4cbad15b5f789504b76e65cf201ece6cd8124903bafacc6b072a3e647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5ca221f68910461acc3f14c96f1305ae

SHA1
1f5c4f5fea5d0aac0d51b9891a5e91c7891787bf

SHA256
546fe38d96bb746e3985399800a5317326d42df7c4e3e72de6a1890276e825fb

SHA512
4257ac354dce6926964d23cc981a46b371bea6bcca0f81a16119b1fcce8774563c2e49dd76dc5fa3e6e97481f1c66f0480749ddc8f951053d066412963a8b683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e1ab823967ffc9f476b3a182db36d076

SHA1
31fbe9e409470482920985dd969cf10b3d4d9d5b

SHA256
14fd5e19070bcd31e8d5935768f71ee372494eac135ad45b1b48a79d6095dea4

SHA512
8efa76e3d572925a2518654498c8a4d1b843c1c34f3bcaa994f01537168fbc4e2abe37aedb9692f7665e2d31477d7b2d43813855d6e7bcbd323634ef37c5e631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1ade83b9b4adca0b8c69f6dd8dbb9482

SHA1
9f597eb64f4c2089d073a48acf85778176c140eb

SHA256
80be11664227894d32d2f509bae0a80fd8130bfbaa6df0cb2b77500c8eb66e92

SHA512
06178cd44df042002e72d9db788317351be8fdcc42cebadd3032207d36d5940ecd9e0affcd35c069cc5dce9b45173f333ab93d0ead4049d02a57131657afec33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6220a2f47beae5a6e8246c6201ac7c14

SHA1
a9cff123fe8ceff964d52292c8252ef7e61b4804

SHA256
12826bbf7711e2e01770e43381ce9b43050fa2a7df8a1b0ca9bca386eab88768

SHA512
d75c3934f22258922f4547e11c6ec87f312a39182dd24622a833766f9afc75f5d24fa4ae1e8882e0a26396f7795d9c6ed8cfb5bf20948d645ae5fff26b990876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
84de30c95f602a493f529223e4405ea3

SHA1
c9dbf4ab0f95db3317ae1dcf42f0ef3b0fc9ca1f

SHA256
993fbce98712f2764f561c2c232caa5e413a37a42c386a4b17f12e6d7c974007

SHA512
97156281b1979c5d8c52e13ee2ba35dc1e75dc6510e6301d98ee2d5baddf45388f42e4cab85803375af967d4a1942fa1b19a292ef26e4a7f25ef2abd1f8ca71e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
33cf1c9dd0a176996dcdc49ff49973f8

SHA1
5f4bb8abb9e72123db4260610fa14a45aef2cb56

SHA256
b0d0378bf439b0a23161a0477fe5e1de6c4fe8266fed206bce9e4e7446d1192f

SHA512
4672c49537dbd2e5b3ee7c9b98431312e53ac4eaf016a2d3df98ce036a4730699ee04c739921eb20f7b8458ed82a7f3f60065e80d8c46afe47f0ce597b2cd603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8616ac0442312265f0121fc6dcc08e89

SHA1
a8525ce2eff5fbafdcc383b942be8fe689ad9b1a

SHA256
2ca7a947135e19a8800195bc21c4f679b272cdbab4ba9fa325219ede3edc3204

SHA512
a2732934b105375adba53a6c10f521a64abe633e6d59271c32131d743f83f2b9db484ff5beb4ed6fa1a6e8e66a3c3111edadc9c5851a95ba5cecf87714a5bcea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5f363c1e635a141a31b63b6c18acc823

SHA1
6421d9541fb3f9f845192232ff4221b14bde639c

SHA256
1601ca389557bf88f3e05455036f27ed356fd45311caa1520ee2d22901fa3229

SHA512
ea8bedf91b1b83fc5b3e011c7902a3b723096c4260d1bb68eb85fba798bbc02d8ab2497072c682b258e8d67434d54cf9e6c8b448ad1457e5fb15471073cc339c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
80ac9584a9dd04262927c3b42da10d6e

SHA1
9e1cfd84a975fd93cf8c06194fcc03b64cb221a4

SHA256
276f1f63aaa4592eec250ba6c40cf8ef1eec2ae95cec13cca75fbf85ea770983

SHA512
34977bcf95c42d9c76124ee6a9370044df0f2adb0daf470cb93c988df926d0976f5f3f1a36db01a65c86bbdd1ffcc9ef39c0307592236574a4bb32d23aefe616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
eea59996cf33ac4de6ecde93916207a8

SHA1
154719417a70b873293ac12876efd7958820fa53

SHA256
3dd5d23b83a073605576115d65aa7d98960e1c4a03b25d787abf5f09fa1039e5

SHA512
78932ca94dea3251a51bc613e9a3ab7e42303467ca946274cb66a2333ca04b4577ac14b8c74c8cc8ac0339f04f184032da634d0574c96f0059b107a8100cb6f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
00c3411fb7b0c3ace194dbe592020d25

SHA1
04ae3995a2728fe9a82186d2b3eb102ef98f5f2e

SHA256
5463397aa9d383fb8701f8b8e1466b899cf41eca1870aae3a35ae204f75bf6e3

SHA512
42a72efdadaae5168b9439124f14926fd2466f10c43cf6716469bd61767a7a08191878016f3fdbff0504f5387f8fc1f54fca7da6abd21408c01f86040321d8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1d23c70d99e7a88b56312e70fcfa450a

SHA1
87d1a6573b1074dddd85f707339e864a1006ec34

SHA256
cc41c071b8611e2ebc845f8f14d33353b3dbff69c7c9d122483ecfe0b50a45fa

SHA512
e17f6d45dcb33749f3654f80134bb45be4cec4e18e9f61a7b93d4ced2255c6fb9b9a89def04f0004202086cf11c5179fda6537f2dae9d51191b62353838af49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36f0a8a6aaeeb2fa1dcc7a7670d76d41

SHA1
685afb8c929c0446ae52c508b2e606eb188de120

SHA256
d5eb82721300d9353ca65be1de63d6354447c98565db074da5ae5b9af6675731

SHA512
0d4d7c7310314f2dd4c6ab2e035b2856375127df9937b1153eda7c9e6717e9ed631b4afe620c4a42d08200617eb5726dbadbe8c6788ba0e97f8216dfef6f1805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7b3effba625776165ab5d5df0a30411

SHA1
88d366ccc694f6b769c6e51f95b5637ba1376913

SHA256
3a7629625faf399245891a4e723e47b056fbd97019e8a511cea3dcea9b611781

SHA512
07e6a180a30d493e575f7f752b9340c3d3f5b8f76595fadaeeb95b2c98df0e851a9c8bb9c2f044657b60687474cb2c9f2bfd182ccdf0e50e831ed242812fa8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e847cb5d8a0e4bf803c76b2f6a296ab

SHA1
c7d99b12b49356b368cf492a62c679dec97a387e

SHA256
6b13473ce44a73ee5cc85839d068ea436df0f62a78545594afa21a4c7b66acff

SHA512
842c8973f6da766e7bc13d21acc33a367315b02a6f0244a8813b4ef4fa60f74289bd2fbb90cfa18c6cf633a1d14fc576f8352e5acf02c83d9c7c08923eebb706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7b0f373100cad88cf5663ff851a2122f

SHA1
83a9575a08712242344172eda831b765ef381426

SHA256
4aec8196147306982d2ee1ea11de6124a6aa19f5717c7f9c04d5495ca4202dad

SHA512
30c53f3a599f3a5541ff6d955dac26bd6842bb23c62081f0b33e339b5a05c9a6d4789266fda5a5929b3e0f2af7e982ae99d680eed90eabb376ea278b372ee90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eebbbd24086b51d3010eca699801e211

SHA1
d1972c7b97271534c35b817bc5e02c6a532481dd

SHA256
f6245ae351d84d7c61d45adff1de459fde0e3fbbe58ec0532d2cde3f716b0431

SHA512
1bb8b908f03fe6df3391c0b1ee05a3bc3567393afd8919314820285b7a6c23defb1773663a89d74b615eb0859c7ad6c263cccc35321a0d7b7d8ae8f67653b9a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3ead1e2c168b52fe8f64d946a9c072ce

SHA1
24d85d7fea64313659b15a8d9ab11701e4d53cde

SHA256
122e4687936aeab3d4227f08bff6b900a395d14895cafcb2f6f69c66dbf07c7f

SHA512
1e6f620676aa73810496ac26b7c1d07d0f428d83b0b91d3f419874d55edef78a9572d2eb77f0b0120278fbed7280866d0c382aad2ca8f9999bbc68b8df58b489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c8bf0a45ac83bfdac760c8ecbfba86d6

SHA1
6f71f6d11e495c3a71b9f163be433633304525eb

SHA256
2e7a039bbeaf6ae3daf0b10fc02c4a2c514f8a988a9ced6cee8e1fdf542c9f18

SHA512
46d8567324832babd2991057d2a3ea5e1935c2de51b12ecdb57f784aa9b617726340c2542cd56948c0eb3e7ff62869bfaa6ba52f3e71ae6f3f2819a7d1656350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5af91ab1fb373faa76a1749f32ff78b8

SHA1
334a6ef6eff8fe88e64b494744845e1f28a07ea0

SHA256
84aec311b773a3e3c5bf23df04bdbf6e7cebc051b05e4d7ab4c6b9b1b9992b83

SHA512
e683e095f4ccc1ec140021fbd275e70f1d3d329720ddd9f06536a6ce37ceb6205bd50c00ea39eb09eeddd2ffef0b1f48abeeede0c60e03e831cb9e7c4c0102f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f795c90e7f273516043064c24e411ba6

SHA1
7ea5dddb8f2021f203373b9e685671baa8336d2e

SHA256
513552d54e496308872067865f325aad746e1ed8cf841fa34658cea629e671e6

SHA512
cfa2edbb9fd0ab072d370f5856c60b617dbc533366ce11eff5dfb70271ae82a628ab781174c4b8ac70cc49d26f6eac1f348e6fed69226f3f25affded55bc098e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
acd0c428baa7ac178e55d59b43a925b6

SHA1
9dc57f0c0ede3a09fc50e24ba7770c1f90d3e1ac

SHA256
60bdbce2bf36415c73af9b404a329a6a0971f77f01bdc628a49faf79ebb62c20

SHA512
6793f251325daf5125b260d87af17516a1d43343fefb219e86c910429ef6e2f77d0c398fb61b49dd05e9a744fc0e7fb8ea3a43b32ec1e6859f3c9fbfa63b4c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f2d923fc1eb8e18edbc8ed50cb20c1b5

SHA1
50ef86bc07c3315223f80eae6d21b62dcc1a3a4a

SHA256
5399fc78a04ff2d08a98598eeb6b4d0045eb3257b5864ce1f50b6eddff2f5428

SHA512
ceb3ecc1b02f06397a1f26aed0c9187e3fe11a9aba5782d6cfe19ff7688a4c5f1c0ad29365b2ee3886a4904a503cfa07bb94aa744a8d32d650fff7cb82773f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d417bd830f3301b84aa7e4fdd3334e3c

SHA1
8ed9bec1acf58247f2ef350896d853beef068c5c

SHA256
4a7a9a5203928bd149a7af23cfc83c0e3398c3ac3b88ce403f62e4579511d9fe

SHA512
fe6086c427f4b8bc1c47389e9d78df57662bd9f86832cf19d66110bd89250d271ee808f3843386b5d7c64e30e10ac2d3e9d4b57a0c86eda43fc5ccee1b3505c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84980dc38580c5593edfcb5ebad0d17b

SHA1
4d311b2d84be66ad2eefa642543320d767936c1b

SHA256
c68d5d17fa7aa9bfd03f741dc54871924cd792acb96679d814e3b958fd9fccac

SHA512
c12091bbf436bb143e6d6880549ad47445e9e601fca2dbc470d7d7684b44e9cb2c1d45762f60aae06d0cdf17631bddcad0a9a17f18576579690a3ea120223f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bfe1d5721e59d33aabe09b3e6e2b0e81

SHA1
e9e55d989811a39fd36e1e0da37457feeef5cc41

SHA256
ef4f96fe9bedaab8f5825024362785e13e4093496408cdb2436f2490e47c2755

SHA512
3866e7e7050dbb6d759ca6c567f18b38cadd9571b65dd82713a4172e4240ec722ec648d567e8cca22b1763f1b440b9dfc1a703c6e6eb67f5953c9c83c69fad0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1cab6dec2866c5cf97c48af3c81e87f3

SHA1
ef5b1aa09a9a9a4586d3b1a48be1c0a4b60829ef

SHA256
9e9b6ac5a82cf31c8116b2c3538da6b6aa78332c1ef6438cc535a89f85ecb0e2

SHA512
eb870c53f8febba201f874ccb7ebeb9f97b1a21ca1017ff9a50e091419ed4285f6ccbee48471df067bbb0f0d846681001277fa65299d58c512d4bbd64c2dbb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
880d2817891129054c4186b6bc0eab38

SHA1
9d40266f65c2693aa0c182beb09b300c7dc06ab3

SHA256
bc228dd9f3f90b9ffd4e2bb3bbb1544e0b54da4013cd84608f29cf2c9f5a8201

SHA512
2273706d8715a840542481b443391ccebf7ec796fb47e8a64b6dd7a6a46314b924ff7a309ce783a0b7d60ca0344c324fffddad62e39f961ea375d8717214e43c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
da8f64bca8897628cebc6cd8ba997aa2

SHA1
f27d1770a2f71508f527537dea1c09df71f59abe

SHA256
b48d4471b0f5a8d66652f5b2cd00040de985da4f75ddc81c2381a32202dc6df0

SHA512
d51ccdf89eca7eb70cbe8885ac5ec92cdd2314d22f2eb1ec3d7decad6417daf42ef088e4090fe0407aa60c674beb2a54a5ee97690ca09a648d54f989820c9738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
43fe6e652e60be62ad61f234b13b5778

SHA1
d61e40487728f9d358259b9d26680f806cdbac83

SHA256
b25ee0aba94b26d52017647a777b498cd5b651e390284e970cc594396f51793a

SHA512
d21695cb7d5b60a39dace533367d3beb3df0da4c4d6e084203735c89c1b0f2c1f014447d388709cd2eb1b4524ee5d89d1704a2e09b686559f05c3d0b45593e0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5e645603546b9c35b889c318b63dfad5

SHA1
6df07ac5630f8ae401fb8d074be95acf6fba0df0

SHA256
24f42e5a5294a0399d410734817c7818a218b69931c6c6b82c4503ddae8b1f63

SHA512
a6d1b1c38abb2bcacd63505d7d5bfbd17d9339d7693eb136528e875cab17951bfc5f368e94bd49ceae16e35d0e8f47e74d566ac09c7207d085113450505f563f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
61385b71fbcdaa1e9aea9717c4f765da

SHA1
bd5a27ff0d67a6227212b6c013c09f5893b3fb2a

SHA256
5de5f1b293fec086d238c1ad4e289d8c96e67d9b45d5a99eed588f504c7df27e

SHA512
064dfa89fa6e41e5110930f1819daa265987a980c6d1aa69d6308c2fd3e9b756cc8869c46496d2e5ebfce9dc65d8984856aff1ba62939631123f9f666c032408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
040082bf91c4e1e4a06d51bf9073681a

SHA1
0ec20bc5232af222c1755efc484375d604b2425e

SHA256
ae82c3bef11812dacf14cf278ff087c1d026b48ae2b91ed25299b9d666e8a151

SHA512
6ec8f63dc0d9b0be286799667163889db4bdaa1062b25b5de3807d8125ae16e93d745cbc6a33ea7adfb93890e50e9526944459bf4ea3c7d26c79db0016b481fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58430f.TMP

Filesize
203B

MD5
15dcd5fa7e2f22126ad299de70ffe241

SHA1
12f90f91e17552ea24a4bdf06a71c978587b1190

SHA256
0f3d1605452c48a9e3599618a3d4c4e80528e9fd8c5dbf34ba6f920c0ea8dd92

SHA512
e0297272902e608a724b8309adf95fbd7bcbf30fcc01951ff9320abe114e4065d461b6f311ee63da7b54e8702d2e2dd7183b70b74a124a42fa56c8474eb2c539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e8af85b842e465c5144e118f51006bb

SHA1
a45b369fbefeba198fa447848b5c391095dc96d5

SHA256
ecb6d4ef436dbab8f97b786d2f1f2b3b02878d95b469e6522b01162d8cf5b04e

SHA512
a951aaf9962c2265b2aa1b0e2d194280dd78277e8429f820f4460abe56f7cb74970df406c035f1ac4bee0ef097569c3c0cc5d9f4306904ef594de37e1ca6a9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
58fa02021fe641ff7264d7100584bead

SHA1
7951ed7d6a57adfe6a03d8500bcb5e0e022a2c29

SHA256
891c91322b6dc9e3516ddaef450753e8ef596aef270bfbbbdf83953faa121e9e

SHA512
ad1c40bce934da235c2a9d42bb7e43046df83c78018286e0ec748586dd022cd2d989e22a1b58f56ea653883e4f3768ed2721a5d47d9feacd46d4e7e49f9fb115

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f90ab551c89d2b8c14ff3d6eef0ea4e2

SHA1
2d2b32c37f20babd421315fcea6fa91125b9eac5

SHA256
b80a64612247757c445e7da34f6d6b06ebfe20806668eaf8b679e61d1b511b73

SHA512
6c8142d5bfb18235f4b56677c753ccfef993094cd5c93b6532c5864f98b59052df2d073bac1a9ef072574960e96381e34f01d5802299a6617d7ab65cfe7d16a8

Download Submit