hxxp://getgamez[.]net

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://getgamez.net

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
4872	msedge.exe
4872	msedge.exe
2432	identity_helper.exe
2432	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1916	4872	msedge.exe	87
PID 4872 wrote to memory of 1916	4872	msedge.exe	87
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 2480	4872	msedge.exe	90
PID 4872 wrote to memory of 736	4872	msedge.exe	91
PID 4872 wrote to memory of 736	4872	msedge.exe	91
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92
PID 4872 wrote to memory of 3292	4872	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getgamez.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb90f246f8,0x7ffb90f24708,0x7ffb90f24718
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7704 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7932 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7908 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
27KB

MD5
8d327694df3ebcbf19980f6553fe85a4

SHA1
ebee1e2e1c18a7df8be0cae7981770823e4db97f

SHA256
476cdac0e6b6f629fe3ef9716991455b515d87dda1651c3be37df4f3d3bc9a36

SHA512
1fa16800389256b0a70a4f519fedcc658ece5971f07c363bcb77b7267b1e9c3991b7f74be16db6223ad3b442029e4014e46ea7c87719c25f795204d2967056cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
49KB

MD5
7450bc3c7420bc5c1de8a4b5ec2d0cef

SHA1
583a1dc7f6b2750c0749633ad589442c15676267

SHA256
eb210b6abc60e5bb93d2a62f6467a74e9c7ca917dbc43e64b9125c5f2af2224a

SHA512
b4cd6182d040e971a25bb64ddf32b817ddd80df0f18363c9ed373b246f571f421014cda6fd5fd468715a183bbb0ddf3a62a4ba3f78889489d2b3344d7bf596b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
39KB

MD5
f3bae3b15f77db74cd275fa7a488df45

SHA1
85e480d39c687b19e52b489026ed2371dae162bf

SHA256
54d917679905046a903918cd3f57c3cfdd8bfa8bf6460bfa58b47506acee88e2

SHA512
c438b79e3dbbb4c74b6f6471cb429283f2347b2b16176fe3b72a3ec8351064542939bd1ff20b7cc94e8651499deaf5c00f91cab3dd091ee35d4b5340c4127ef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
29KB

MD5
3bca66397f0e4b3861a1ef5db9167c67

SHA1
72e352d710edbd5f1ceeb81ba64b5ee8b17b8644

SHA256
33fe45396e433acbab55814623ac74c9b61084546892cd407fb19d61a9810e71

SHA512
01249e3aa63e77e15a1df025e1de2c6ac10385db6a5dc1156de605829a3551348f948b9a0ff5c6203ee21f2f4f378f98d9a9548d8a9798e057f8aee8ed47d801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
32KB

MD5
ebd94e7766ab1038ebc2885064da3471

SHA1
f23e91fc975dc8377365f5b653300db3c52eff85

SHA256
a90132d0c3ec0a1cd36bf50e490740d1562bd1c836573116c5dca932b25c9a52

SHA512
556e154c6e95b6063d8f41c0d507a2a7f426ad8ced09df7bb6a4622e81326c675deed1316768f77939eab653806b972eb5bb08ee83e03f74c3a050ba25792bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
75KB

MD5
af7ae505a9eed503f8b8e6982036873e

SHA1
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c

SHA256
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

SHA512
838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
27732a62f2d24b689c41701ba7d8c9d9

SHA1
a2f983ef2353bc0d194e8bce0f28b018b148beab

SHA256
a0d82f22906ec0e5912410934b699bd6d7f28055676c4c462ce46016d5d8d96b

SHA512
59f80d24e2f5f45160b2991c8b6c2f624e584afd04f057ecf541b2831584bed85d1205d5b05f5ca1475ff444b3a381b3dfa300d30dc2cd91eafbfc4f87a3ebbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wheebsadree.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
522640ceedac31823e00bb44968d2a2a

SHA1
a74908d0859ee0cc427d70d7f1f8edb5bfef9c3a

SHA256
5a4e73882454ef64df4136cd505c3823b50fe239a995053cb6c81894219da2d7

SHA512
1d8854cf4939c8929df0ce5a0992a53f5950a1acdcc56c559cd1302fac7d700166674c6260a11f2d9ab2f6630dfd7b6ca4a3d5b12ef56e6a2454a9e8ca5092ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3f3c9340d774c3c9969356e073715b35

SHA1
0d67333a5bd4d070e5266f93fa7dac66e9112f71

SHA256
ca7bcccf422be7f08a29397e852a17230be43d410ebdb51809434883456c4372

SHA512
5369d8a08fb00f74620970f82dc46a3991c2847bb8cd0a8421ffeedb213e52d46ac0b06782c8123171c98ceaca4452efddc53dca2a552cf417d092bf96735165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9c3b14701be7ff693c464b378bdd9fd5

SHA1
5ef0f05a11338658974288f126dab84b5bdccf5e

SHA256
8a88f354aee94b0a9f9c37000c68dfd0c71eb097d819a8729e2d08ccbb9435be

SHA512
5f4966b5d6e5d9887f0f86661b24b7042d1d0d928644d8d8b7fdc5dc1ef93f34fa229a532d3a1bb9da81002ad4f9ea94bce8a144ee6cac006ec5370dbfead6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d94acb44b7baaf6320b2a6265f498a47

SHA1
eacc5011c6cb0a4f6a5e031af48aab04fea4b8c3

SHA256
392d5988f4821f886872e118ec6ea07f8f37362d2b64738832a4fb1b27caed9e

SHA512
64db831ed833b7d9591c82da2478e663b39f386f9150e402a5f3b6ca4fc0638055803b32f76b72ebab47f1cc03a380195a2b93df4476e5415469ccddf6984a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
2a0fa451d02a8ffd346651b0c9f4ed18

SHA1
e54d948f0435bd0369b3446df6afb496d4f3c923

SHA256
4a863bdbc28d499752222b4aa2145606f22befb9ba5989c29d89d77a82b51fc5

SHA512
4bc1d177b5d8017f8eb909b3d0fe1f62b35487b8d3b37270621e34e3b34ae80ff56b61b4c2048d2cded002df3b0144e9629e01aa9e016831c72be4012c114558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8543a80a5eec0b0586b61117fb07410f

SHA1
6cf267be032ab7da0c6c7f25dd5def16e4016e8f

SHA256
f3dd8311474b7b6646ff4ea8c4564a6f7f6461f74bf40a63227245ab8025814b

SHA512
1590af845c9f2f43df12cf2d181ad3a37352032d72dff7d16511620d1ef085a410962f565fcf90d6c03d0e6df29ca7108ec1f8cfa74b0a47c4c0b270518b68ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e7f92d5e8fd4dbdc5dfd350cbc6c8b49

SHA1
3b344f412acb3488e144e643e883ee0ce9d2510b

SHA256
9d9472b82f77a5ea4ef388a8707c3e0c2e4653c5ed8604b4a818e1d816a9e254

SHA512
c5a623eb22ba94fd8970f840f3d580fc4682f31ece4743618f63e517437ed7303b280b7e5f1ea8d2ee60e0bc3e0aa6c597aa0e672dad16ad69b6af9274c6c07e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
104c1f909eeac6297d4b5f6ead8b440f

SHA1
898c9daa3a26b60e10d829573377f0b8017a8b53

SHA256
059621d608143c86eb131701f1186e83de9986569dc05bc1cd952d982ff5ab65

SHA512
fcda1d82328948b4a4bfc3dba3cb5feef10a75543939d6ab9f25e198e1aa5eb5e2275d8c68058cdc20c4d05f0fe99bfbcf813f65206add072695d88eab568c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
01d20f2cb49197588da38c18aeb4ca31

SHA1
6e8e8a1ffc467a4827c1ffd8a34639f03669dfc3

SHA256
8d0c4679866f6432bffde335f8fb11a53d2e43c1559a76760efb0e639daf47af

SHA512
b4d08cc04a05b003a5294717249f9a764f2e51712dcec903216c01ab66259981f3bf7c53ab560273acd6022aa6aeaecc7efed52065bcd54310d66e3063f755b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
b66a09a583c63bcf4adf6662e3688450

SHA1
b04c4ed6b48f16b9b33c56e640c1c62984bf280d

SHA256
e63c64aa1a98adee5d6a5db6f9dc4d94a8c5ce454d4b9717a4100a477dd95ea6

SHA512
8ea9518862de335dbfe8dc69e692814156cbe87b7be7b964b2a5f37a224f9e79aa659a1e55df8e9f0b3945152d17250f647ec42755b4456de2b5f7068b41207f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
a96d5d95d7ba960d5bc5bf382debb15e

SHA1
637168ce3eee551ed8363635d8a3dc15f77303d9

SHA256
73f95d48774df9d959e512af49b5f6905bd2585d3385b69d772f833ac7e8cb79

SHA512
963e51344b8e7f706b88ca4fbbc22ac05e8d1aa6eb5884fe1d7a25497324aa4df2f7391505f070efa014c7927fe9165da571d9ba1684422dc6392fcfe4e92bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c592.TMP

Filesize
48B

MD5
786b53df264d7c6843485e4139ab7594

SHA1
f2a60b7f5c46368c08fad264739fd39c09b92d68

SHA256
8d57251f4422793e706ead8dabfb640bca7c4e1bbad0da5fc9c4737917af4831

SHA512
f49bbcb7bce2263bd8c57775af9b63bdda6dfaaac8d798e47a3ad4fcfc19c937606b9d40093648f410d2ccd656554a00c99585ed04d9532e780478a9ead5ac38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9de94c28c74721367416323b3eb11406

SHA1
f03ab127df768e022546be2eb8132346536285a3

SHA256
f37ebed0f632638a04a30ac7e2ff93526975217836be6715c8ae8a87db525d9b

SHA512
d6d41ae3d747fceda1e66a3f6ad316024f595998ccae860018bd36e171df3796ba751f40cd66a146fb30ac79b9ef89e4c813685b3b221d1de4ba360bd59d312c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
41b779e5a1445985448680934598419e

SHA1
454cbd80d0354fa9425a5d5fe1b873107aa8daca

SHA256
1ad4a5fc0935d317693cf1ee2dbe45d5d37057dfd6520d905ec3ef6fd391e18b

SHA512
7f9b8562a96c543873db598e842266b9106b3d485842c97d2d250adb8976d363c9c161320843aee33928c0b8af13cedd6de3f0725472737a38538a4eff5b740f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1190934b95676bcd042165afca5a82ee

SHA1
fc99fb9ee58c81ba375c092e249ce30d22b99819

SHA256
e7b78333e41f01f8af23b4366c19b326e12b1decd27de022e3afb2210ba7a56f

SHA512
373ce5736d8c93678a8059531a014869df2d6aa26249f377ea6c94c2b64d9525803fd3c03c88c41cf3e8ce975f16c7b6bf671c9204190e0d990b50d117bbb2ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
acd1bc25709f6f1c4d26b09c4a2c54b6

SHA1
bb6fb6ec34cb7df8754bc06b30f6f5b76f24074a

SHA256
d777469fdd091694d55a8f9bcc90926716153b57a22540d71d16a7852954a9b9

SHA512
fc88ee70502547f447bb3381555b84ea68a6c66c7b036d9a5e1979abae0ffa39031af1d99a209639bd16f4b6262738094d8703865c00315fcc745e2a9c70ddf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
db8aa81edf98054874f6608629c16703

SHA1
0ed74dfdc845ee5a89dd21d4c29a6d05a3018502

SHA256
94dbb1979dd4760220d7c53caa8715c9f345ac6addbfc7ebfa89180a136ca6e8

SHA512
4157f50aad4a9f478bff8600a3059228ece12f453970681d5c0d48d203b10b014d2cbb558c5835d5fc7372c4fbae892ea5d5e5d14cce4915d73a616dd163d240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58177b.TMP

Filesize
1KB

MD5
ab505f2435e547ad2af07a956ac1b47e

SHA1
e112ada46cc222aa9ad5a169c977674a10c45a6d

SHA256
a308ef549fe8311523bc65d744471407e9177a3f6b19406f3455c27a48a6b197

SHA512
d9991f46ccf96f31e69df54ac27a542dca783b0ade80ae8fc8e4dcf2f1bd0e7f5a8950c0c292bd16cb0c317090b461bdb8fb15b568381546839210f42ccb8787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8e3aa97-fa30-4dab-ad66-95ae2d0d5531.tmp

Filesize
6KB

MD5
72a90e77e69ebe2f06c72e176093325d

SHA1
90966ec08cda4dc96ce59dd60881275201861d33

SHA256
607f2785e6b0396fb526f5ab0975ffc660f97a387dfd9aa6b50c62de71654eb6

SHA512
676a281c54634fde70e0805cb648cc8e5a5b71b67afaea40cd5e2a0d7e420aa071002b02828a17045ee6763ce8ff8c912583b68ad3404d5ea0f5cce28ab9fe14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97681cc42403273adb7a981ea3d2a16d

SHA1
fef065f897cdbc3d43f746614cc3b3ef66e640f1

SHA256
6f812ca9324e96f39f88da52b272492d511de36a3c52887e7b800c1a7aa5764b

SHA512
c230fdc36974f360d3d614685eba0c3d8bff3171dcfd48bd3ad276dfaded1e6390cde1511b66c4de68ac1ddd0d15bede5762955a9f9a5583aa8ab7068ed18f10

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
c7632539273f9c935fd83b86fdd39de4

SHA1
7821085888d994fe9b4a53a7fd2a05b01ffdfbd5

SHA256
a6708e8fdb68d4fc02df866a02547fbed160c0f2c54c370e2214d8a8d49dfa2d

SHA512
1856f5ab09335d67e427002e1045e4cd7bc3e5175639006f662970877e57653a3ee1c9ad09ece9d7de793682753bdff04276f82510e21c38419099c4d89c562f

Download Submit