hxxp://google[.]com

Analysis

max time kernel
433s
max time network
433s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
57	whatismyipaddress.com
58	whatismyipaddress.com
59	whatismyipaddress.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{345943D2-6C8D-48B3-8043-2E4D1B6DA38A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
1800	msedge.exe
1800	msedge.exe
3144	identity_helper.exe
3144	identity_helper.exe
5128	msedge.exe
5128	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1240	1800	msedge.exe	81
PID 1800 wrote to memory of 1240	1800	msedge.exe	81
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2288	1800	msedge.exe	83
PID 1800 wrote to memory of 2688	1800	msedge.exe	84
PID 1800 wrote to memory of 2688	1800	msedge.exe	84
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85
PID 1800 wrote to memory of 3680	1800	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc0446f8,0x7ffcfc044708,0x7ffcfc044718
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7688 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7880 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17419708190880102506,7189159608042849808,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
64KB

MD5
9ab10d71ba9d5687f36807e669b870d1

SHA1
e156f2cfdda7b5dcca0db32860759e954626e6f1

SHA256
7cdc09376d5fad31e928ac542ed83ed3ddfc5507180e94417b0cf4116b1c15e4

SHA512
c70c189dd7e515c2317a276319668073b8f73151bf7a1e0b6623ce888f590cebc7b7a69fd0b39cf7fb5206166202b6cf9b1baeec9c59ed9b3f926c7d7e13935e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
243KB

MD5
86cdc24ddb1f305ce7469d11e84e43c6

SHA1
f6fe67518fbf9abda73cc187f791dbb334fc1c20

SHA256
8bfdc30c745db5c75a8c0f56299e36a1d98386118d3149ff6badbb945af18a5f

SHA512
de9c3715f35ce3490184e7dfeb5c3b87a286378dcab30f86fd850916fb993a5c8d955df690228bca8518b430098fd805560dd4965cc3b74395ed75ea2fabca2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

Filesize
1024KB

MD5
0bad7664b0eaa4ca2017ad64881b5a36

SHA1
3da87019a9a19e42085c86cb5f514c2a918d7eff

SHA256
e9f1244c53debff7056df549333c6b8ce21a6ea5d0e1cb060244e5efa1da9f2c

SHA512
0a36d8207fec697e54c9ece2ad2f36c6a785e37de3964f75919ae75050aa7066c882e4613007990458624c413d92066fca77ae0bc00257f290797e03ac550b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
1024KB

MD5
344770f7e5742c50eef1d7048da99421

SHA1
310039b2a17db5882786b1f7abc990ead5d8eaf2

SHA256
faf4cc44f6652f1c46707c8a63b7b3bc9db7ef7e00770cda04be0c0b1229eb75

SHA512
be6f17ee91efcba6ffd5df13e9a8fda7ff628984029bb60d61c1f1819eabdeca5462bbb50670117d121d752ad1a9a6be8ec1d702e57863c6597e3fe92417f360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
1024KB

MD5
c1c52c553afa8cb8ca74236fdaac01b1

SHA1
02a1148258b6cc1855d6b8ae07260286e91cdadc

SHA256
a5a04ede6de06850622e0aa07952e4a21221ee55518515b87a25302bfda7c075

SHA512
53c6813d9cf57151db1347e079dacc60708775c52c7b3f4f6f533fab09c80b03323e9308b851747659f22320a2fb99891de9d739ca12982437db1302d5693f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062

Filesize
540KB

MD5
7c9a65350c2fdc3dfc8a0df8cf16eda7

SHA1
a5ec5d41a8cee225867adc161b65cf6b94ff60f4

SHA256
4e185c1e79a5100a728ca4dbfe788239072b6d237fc6a26d176c48bea2760c47

SHA512
f0f09178cf903d13531ef1d7bd581a0cdba34dd5e5b72e25cac7bead2a65f02dfcd213b2e4546ce93ff1f2f51894c2b8502904439965ccdced98290de556edc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067

Filesize
1024KB

MD5
0064f451e42281c248575270e524e92f

SHA1
fc069edf9b3f1d10230b73ed4d7c7141a106c908

SHA256
65ee4ea30136cc496d24f8915cc448955feefd86eae6975886ceeabd42bb6da1

SHA512
466582c3a00b20707d27f2141c72784ca58507d79f1f6d31ddbe1832b71ff90ae31134accbc3a15137d6cac91fb57b6dd424cbd8d76a77448dd0e49f1c58ad93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
122KB

MD5
61c71b4ec42f28d066f82f3badff376a

SHA1
f210d35c7238b9e572e7a3597d5d8a21ee8bb62d

SHA256
a0f9b30ce3ef12db95d2e1b42724ffe2401b43771f5fe1820e42e92a87d81a89

SHA512
2523cde977b7b650b4d1a1a0502e5ee084257d2a49a25f8a7a3735d42e61550a8171f63783c5e57d3d4cc9ff9686a0662f64f8c200005f368b4450f4609527e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074

Filesize
1024KB

MD5
97bc9dc99bcaa76881e17e07a7437b9b

SHA1
5cf4a35e478133c8db0f6d943fbdf528eba59858

SHA256
74b681ee5e3cf3add6d88142f7cc52920c451b0701a8ba209309a4eb41c27d86

SHA512
3d40993e2878ab6960b4b28ba43f389d2b92f05b98304728caa23eedc084d3b392590d479577a978925f6f159c5b227f09730524c2a8d823ee58346db573c97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000075

Filesize
1024KB

MD5
419e0d1cdb35c59c3d1c88ec13ce441a

SHA1
67b4b3c3d5f57cf014b7b01a48972a4d42b0bbce

SHA256
29f6507ca29307ea23ed61b438dc36848fb911c930918782de5e056b5dad9249

SHA512
46897f97e5585bc59a7a1435f09697141a5672ae5ec5941bd6495a93c779ac43508ffdec74b907165b16a49bedbd233dbd2b5d106cd12918db5eb23730dd732b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000076

Filesize
303KB

MD5
636e46d0f572cc7d4ce20cb8783015b5

SHA1
bc2de9e532ff230324ff86d6694f48a0073c6b08

SHA256
b1df85add64f36f228bc42166b3daac0728e1bbe3a6de64bbd3c366e88ba8d11

SHA512
3167532caf4273ba0f3dabf6a751385344b39a950381e53f6e3ca4cbc46341b894749e583e544db7bf092f0b36dae6c2b6680a55e1723bf1399b74cff5199576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f2b65f11c31f82a628d15c62123545f3

SHA1
ce9a05579c6f648c83b27326a6b8c4789ceaa1df

SHA256
b0dc7af1051d576991abfd1fede3bce4ae55c97a2a74ac7fb483907ac14b3e34

SHA512
d129c54f99df2700e7d899b7454dbdcb39af11aaf0edfa7e0002a551cbc6bee3ae67b30a5146e6d952a80bac88116ce30f22bc62e7ee061aab74d0eb6e7b456d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
14KB

MD5
b116947544a5c77dabe730ac00151bd5

SHA1
6043b968e470b3f36bac5b28aea5d176427fb106

SHA256
06498cb9e78052bbc1a21be511d816d0cba2acddc4261ef94ac9850e97830343

SHA512
4f2e743ae1591ec6a2948d16970169a47447402a78d21e1253690be24409ca1866a13f938671da0234248f176ee2f50056b75546c49e0f9a6f6cfed385568059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10c5260e086dd0aac52d27a2401ed57f

SHA1
b65100ba8b911ecc0060b0a9d8ded89f308403cc

SHA256
0846ce9504690f80ba38ec31406385d8d27ed37ac9d1f811e3dde17674ca8236

SHA512
380d4f9e2ce9a9d8e1aa6d03b8b0dc6e1ba640bce46b454008ee172ab9cc9a2972c35c8155fc20714b602509747bd73dabcdb1b437309b23011cc34401d22a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
3e3dc594d988b5e23a9b74f5d62a38a8

SHA1
ca9ae6c421c9f685a967f61877fae9e05d8b5a64

SHA256
2cd70e440d999ad9aa73a53753985ca4758eb46297a21c15ddd6634279ad9329

SHA512
39886fef90e457c7c9fa78d19a98302407dc409b52677719ea3a38781be75c25c2f9157b80ada00693a0a72bbfa4fc394442c4e6008bc41bb335b824e29ad870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
a41db83b400c2334f93927fa2f8bd110

SHA1
bb67c2005f8ba296dc09d5daebcfc924b737df20

SHA256
6b8ddf2d01d8428fd077e172153b664a39650b415ac4898ea228928436a37c83

SHA512
4ec285718e2f2a4cbd773e73e4ec5e24e044aa4b8867b764bf01a0c0bb050732d2e0bfebfd058e4e513376cb379b52e1b5e14d0dee4ae2318a07624ddd63c029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
12e5ae481f84db95ae194d8961c00c55

SHA1
6984dde6b3fecf5013a9193a49e02fa0f5bcd1a0

SHA256
d66f190675cc8dca54f64ec48aecded050c3aaa86ad9ac14e5636046c7e91b40

SHA512
04c1d5ab73ce2a0fc5e54628e5829a7f390013002355d21249164297e64886397d11ba0071ff2910694356639624acb8523c2837bf67c3bd5d6d8df1e7b02d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fcbe0aa02db3e700c29a65169ac079a

SHA1
0cb98d2d7a634a5a800d92ac60cae88a7dc591ec

SHA256
acd7539ced006a99f24314e48648a8cf5481c02e1f90e8188e99b73d2e6aaf61

SHA512
ad2d35aecb8ff689e664debb6617983a1285ff4e05053829c7f1f33fa66713a89cab7fa44ff1a8e3cc8cfd83837b000566cc2a136830ac852ecba566cfa3ba45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
de03676c264412f394dbd0f3a8674d5e

SHA1
5344ddb7affd859467ccf47a481a4d4473dab3af

SHA256
de2b435d20887c90c2678697fd50a78445afc376d0c87092c1946b117f187ba9

SHA512
2bc50e093fd5ede173ec5f080536da71a2624aaf1f5110f7f7b5fd14823eb76606573b08e69ca68b10c123f5a1a6a3baa086906ff40069213e2004e5c96aca80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
65821ba010c03cf79d6df149e0e9284e

SHA1
9329cd8949a5505f1d1adc47483f7a5ac83e7f02

SHA256
6db2fbf80db7ccf98f441a6da2cfb5f159325bca83fdc262c6246ab196abebbd

SHA512
5bd3783f0e804cb51b21f09a2e5fb094144c33ec264db88b352a0c1e086402a5c7b3c59f22fa6e019567620984aec3f62dea46c8af941ff2cf5d228fb08afcd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
9a0ef7a09871098cd7979084ce5e2cd5

SHA1
4e0e11403579b6adfd90e4c800fc6d4c85db9408

SHA256
b34a6e5aecb2574c3c7880d4654041d3bfbbb66fe1bb62cfe4ca08f51b63cab7

SHA512
1a72021ba8606924d18e9dcb70f1558c96133c6028273bc002c2e30a825e5cfeb61d5e700a7ba1372848805e433a12b147a9e14b2d2318cd651b698c97da3025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1f512d2e4f768ed2cf5385d3538b5248

SHA1
ead99272722861a7c4eb888d6e61273adaaf9727

SHA256
b200ad416e70105eb36d768d0fb9bbfb6983f44ab87c83252df019c348ef8a85

SHA512
c3d7f7cb2c3d901b881417381417605dbf95efbb8d25e9de45868c2ab1db50c5ed1c1cf640d87710b04b910f805a4a7656cf03e4d5c322c5e0167ec21530560c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578c42.TMP

Filesize
204B

MD5
986f33f439d9c7203115e2d299d26ad8

SHA1
b01c74a9bdd7c1b5e119c62be341f782b4af1ef2

SHA256
18eb342eb33aa91cb1a4cd828aa60d9337ec7c39e896f31be17f054920462b1b

SHA512
642e84d4787990496a4b9a02d27b14cc52e1c8781a732b14978d6e50a2553586b8e5ba88ddc0f3db9da0efdf902603171d99baa95834e1b3002d8a19df16e628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
242a394d92ef045807c3bf85a4151ffb

SHA1
7bf6c8031ddc1e8b62da81b5f83f471140ae2ebd

SHA256
8748426ca13cc906804a147511b0e3b62c5a931221d2a70a2e75536a94b7cd64

SHA512
60e09e80c53f87ab2ca93b5d44ff70794129432e577647223356256eca8eb19c58af64f94f478b8af1ccf246072c382beedb7277912845b584f3d83806d8a450

Download Submit