hxxps://netorg5340145-my[.]sharepoint[.]com/[:]b[:]/g/personal/info_curreg_com/Ec8hzvxxmjBNjcNA4TBxLK0BFc7pZhrX9CyFCqXw2TaK3A?e=2OxPAo

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://netorg5340145-my.sharepoint.com/:b:/g/personal/info_curreg_com/Ec8hzvxxmjBNjcNA4TBxLK0BFc7pZhrX9CyFCqXw2TaK3A?e=2OxPAo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3571316656-3665257725-2415531812-1000\{00C2EA0C-33E8-4F55-A721-1A00A03AF0AF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
3012	msedge.exe
3012	msedge.exe
1544	identity_helper.exe
1544	identity_helper.exe
5340	msedge.exe
5340	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1284	3012	msedge.exe	83
PID 3012 wrote to memory of 1284	3012	msedge.exe	83
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 3988	3012	msedge.exe	84
PID 3012 wrote to memory of 1652	3012	msedge.exe	85
PID 3012 wrote to memory of 1652	3012	msedge.exe	85
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86
PID 3012 wrote to memory of 1388	3012	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://netorg5340145-my.sharepoint.com/:b:/g/personal/info_curreg_com/Ec8hzvxxmjBNjcNA4TBxLK0BFc7pZhrX9CyFCqXw2TaK3A?e=2OxPAo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee1a946f8,0x7ffee1a94708,0x7ffee1a94718
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6996433446581160998,18294729026309670688,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
38KB

MD5
8c75a2c6ca90de8e8c5a577fad5fa8dc

SHA1
7401fa1fa1d88c68ed0e1054d050534ee53a9681

SHA256
d382628253728d1fbc9095a5e5f5d318e79433920430da5fa2e9c424ec094fd8

SHA512
d12f4ad412671417a9a83e60deab1620e3cd112d55d0ac8ebd5eb5a846bf3f8c490741bfdc0c6b2e169b7146ba3244b7b6cd69a0c2d0fcde2fcd1cfb0ba057aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000120

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
8b328eb055c05dd1af15e7d9a371e1b0

SHA1
b2fe667e54872c9b3d94663394fad58f58d4b6c4

SHA256
a72133efa62bdd3defdd3c2efc792a886a404427d58cc1434e7dc83d121ba870

SHA512
d6a49df80c1cc8975c72fc3a892c86d38879b7aa3d48c704a7033ad8906c2e4e178db5c45dcc5e260cdac862d0199d94996e0298f343c556daae87287bdb82a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e2ea97723f8b5d405491be3cad3bb07f

SHA1
9af4f6face4472ea43247d56cc94278be9330a3d

SHA256
a114813b10d0751f4b9df5c09e7a71d67eb6d3628beeb7ec1d3e65dfcf9971c2

SHA512
36eed1952dcbb72a942961c5eac5fda789fb207075cc3f8a49a674a4543a629bbdddda5de50a688b05f18fa990f4a6d98939489eda0688a039d0f15e79e79b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8b64ee201df7d502b86fd308bc914067

SHA1
4a50a34688726091c76655cf853baa938e9e75b5

SHA256
1c45e761f294170acc00e8be721226b0c3b6b19cf6241fa4b78e520f07813935

SHA512
4975a2f6ded7422450f8674f581df15214829fa92cbf1e3202ff71fdaf4e6bebbf09e29af1e8af961ddf3a6f76231f1384c0e64547aa49fdd4a53bc38738c9ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
769B

MD5
e91f93e4cb0a782bf1a4b3f1f5a71619

SHA1
c1625c057c0654308cecd705f0466240502250e5

SHA256
fdfc2d833133ad5a74d92fc32c85db19943155dbb03ee126a5a6505d82baeed1

SHA512
f81acebb2e04832d2a3b6a9492f97c7312f24acf630dc1d5549665cbc67a95fc9f402f06255cec6aa5e86de7d3d54b941c0c177e807d4831642c3b4404b3d702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a33a56c2721f4ea02d7193b04a3bb09

SHA1
640c77592d1a6afa202b1d88b0f1fb011c9186a1

SHA256
2a563fd82e56e32186a3415aa0055be0f70229e8875e44d88b095299e904b50d

SHA512
54c02e9f2f7c9f752ff780960f2f5c7c8b616cfcb5ee559ddb3f4c9e0b07e8c1c163a8d14e94494335c45a217249576345cb2188a40566523aca7405231a191e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af5c399b213ddb2fa7911412e6e7d220

SHA1
eb34a43bac9a6ff6e552a6e7a0877dfc6e87a767

SHA256
df9fa34cb70c98a5d05acbbbde52c287d22b704723a7f0af7997969fc0edbd2e

SHA512
f71a4431f78ff7624f6979d0a84a49a7e137345552afe80ab5d5f652639dd7191c6f60e04621cd122ee94d0c1cac7632fbc2c8e1f57b37c0abf9e7ea535d8e5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
860dbfd72a7bd76482f701abe940ecbf

SHA1
3878ce296c5c405ac7e6bfbc3e9fd5331d98702f

SHA256
26aef34c38ef192100c88bb1eb51c4ef5e8de808d50bc4e91af5a5440a636498

SHA512
6092d9a0996f5246f5bb34a5ff06f1f136a4503721fdaeff3f002c9a75aa023045866000801f7546636f73b21810c9543f025cfe543862d0734e1ec5469f67cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c653d3b5dca776b5c1276ae2958e5e6f

SHA1
f89882df00af66941381601dbe1b8ee7b97ac915

SHA256
42812d8aa049e9b6c874112a4d4b062e6fcc9ae242475016303145b0d4db31f4

SHA512
1a94846280270ce87c20ec98a9e803a17bf9b33ac917cd71cbf82dab9f10e115778da6e66eb2811f1325009d1f0ec8ec466093776a0f19a75cf866377620cff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\8b162da7-98fc-4b36-927d-9ff7d0d5c886\index-dir\the-real-index

Filesize
768B

MD5
ba08e0c1714804f36a18851928ebe97c

SHA1
805fefd0c3a22ad3529b4f41b46db43857b2dd9c

SHA256
52a39384b2fb95a5a6d8b71796b45ad76f491f6f2732a9e069773151d5585e13

SHA512
f6a602defcfe67b5da787beeac64f96115199111cde5e7ee3048643c5c64526e2491edd5b7b843017a6e10cf65ae24a3c5142006b18e6497f8cbf4de269a39b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\8b162da7-98fc-4b36-927d-9ff7d0d5c886\index-dir\the-real-index~RFe584f44.TMP

Filesize
48B

MD5
917b45c8ec6349f69297894a92175b61

SHA1
fa6e442b015ea5729b12598f1258bc64c6915f0f

SHA256
4ba557f1110c3a307ee8f6c45ca9b9195d4fda00ce00e7432f3e6149381036a2

SHA512
b91cce450697af63af015212296de3cd54d95cdb66b89f51631161a0089c3d8c24ae09e9464f3e1a8f2a7192a77827b7c00f7838ee386107ce73ecffdc7695f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\8b162da7-98fc-4b36-927d-9ff7d0d5c886\todelete_7a48c130a6a40c0e_1_3

Filesize
288KB

MD5
ca367fbdca3f611338fb4a46a2829fb2

SHA1
c94cd4a32abe3bd8fd17b0b41e1fb46a71bffcc0

SHA256
8aeecaec12651061108b52ab28ee8cf7fd825e926dd66cbbb84fd9da06965134

SHA512
aad8073d5e310f6eaf01c4d959eccec0569e34d532d8fc339b9e6d6b0d97613a9f778c9aa991c431cb144eee8e87bb69f47cb4e86c8bba648175ae9e2a4c8995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\b98c7477-6206-4d2e-ba82-0e96a4c04ea7\index-dir\the-real-index

Filesize
120B

MD5
1f8c95df0f16b6da914d4cab9ed9a5e4

SHA1
ec66f672d5ff98c465be621e24de7eed52b25792

SHA256
f7831a49aeb73ae40916ce99b7ef22502795708ad40d679f393e16a2b43ed8ef

SHA512
6cfa90ad904bba6a5da5367387c287015fbe64d87157f19cd020faef4112424984af967ec0b1e98d9553c150afaa4790298f993c848d51d3fed6519bd3743cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\b98c7477-6206-4d2e-ba82-0e96a4c04ea7\index-dir\the-real-index~RFe584bd9.TMP

Filesize
48B

MD5
cb90e15fe12906d5bb3c653b7efc466f

SHA1
b6f2cf2d166e843b101abdc4d0079e9359befa99

SHA256
e1370c34fb6229f1af9077b4e55a28708a71f6e9633295995e39bae3169df794

SHA512
3f798eae6d8ab0f9a5a0b2084b75853078561d5fcb22abd0829bfc94e62346ba44cbbc8fb58ad63fa27312fc55669fead392cca4e699f55eca268b3234e14493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\b98c7477-6206-4d2e-ba82-0e96a4c04ea7\todelete_7a48c130a6a40c0e_0_2

Filesize
142KB

MD5
68cbd5ff0024384f7fe218fe8162dff1

SHA1
035b5b757ac42907dde8b1521a4c3ecafcaf9a79

SHA256
d8d2d90b090d158784402496928725368e6f2c93cdc35c089802a3f8e43fe5a8

SHA512
dea887a1d1ca1429fa3cbaf5752af73120f02cb2e8f8b75f1e94141d6ae77f3944a6882b72b2532cc7463307f30bf33f8a406305395da269f3bf60db3857aa13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\bad18b2b-d1bf-4164-a0dd-f44c90ce8fd0\index-dir\the-real-index

Filesize
20KB

MD5
dd900c79d1e4d95b6c9b75d80e5b9b3f

SHA1
f16ffe3a4c1297ae7e104f3beb4fcd2312fd92b3

SHA256
a36401c08ef2cd61fc18a3466a0f155e44fdeb2d5fb76a47d401c80886951741

SHA512
d69a8709d091d46c1fadf2c69657797938657af45817e54db1fdf1e9eb8f1e969459ba35faa282d87992d60fbb54fb692e2e0a46e1564d2dd22de229780037b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\bad18b2b-d1bf-4164-a0dd-f44c90ce8fd0\index-dir\the-real-index~RFe585f71.TMP

Filesize
48B

MD5
421b49b2f752f16a05a77f632d8cfc87

SHA1
444304e15e76746e21528f3453dd294972948931

SHA256
2181250764b308340bb67307e233a2bd6e4a5876812859856ef9e677ac586634

SHA512
9977008a9fcdb0373f4ac3f37f26ff2b8fe33c2fa1b759f6fee87696ed200b6478bfbf677f3b3ccaa9cefd91d410ff1a0b0d3238efab625c66b1783af5fa268d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\index.txt

Filesize
113B

MD5
11c53ac50744088d022e7b8136e665dc

SHA1
eae2593ee10676a74cb05ec8ee74726fc5ebf0a0

SHA256
07db1662dcf95687e20f0b9a787bbe7c65dfb07fd557ef4f59fe9c98c25125c7

SHA512
332d71ee6cd1b65e2d1e0afdaa47557837c1adfbd32b951cb0acecbf8a4b9cb6243777a38ce8c2ffd682bf80064bf6ac12b428760f9e70dd4342087bcb5dd486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\index.txt

Filesize
184B

MD5
f6d2dbe934665d90587277217eef1e15

SHA1
2efde31efca1600b8f06a2a3074caa543d7d0584

SHA256
eeb8b7072667a1a3e3ea4717bd5e4a5b47e1ce08577b2cd81f365f0fd1f2afa4

SHA512
50626ba762c16fc08ae941bd8b176aeb0130afefd54499f9c6cf17924be4ad1c1d03322b3d360fe78990ebfce4ad791f0c78dfd8debaa90d094201c5477fd884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\index.txt

Filesize
250B

MD5
e111d0e01f3b3fdc70a933cccf85f8f4

SHA1
6421b704807101d7b937bde6b489c6e5b492abe3

SHA256
ac97d6da084beb7fe3b86c1996c7cba576f372d48bd6a903e9cf2c26d44ad146

SHA512
9c8214692468a4e6d7ec8c3f789bcf9bc97f123717f31038b04c9c33fcbfb969f269aff52ff6d083d36380c06951ae4cf1a9a031405ef8ffe4194082fdd83b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\index.txt

Filesize
106B

MD5
22a2270746808122cc3552faa0a72645

SHA1
c890bde3cffe1aa6043f2a3ba11b37903afddd76

SHA256
b6c2994efd6327892bf2f087ef24eda6744c4b6035b5a0ebba5a1f1739d3622c

SHA512
d64a2c2a49c193c0c24d90da1401b6f3f2bea13c6fcc1589fbab525ee6daecf0b7963ac0c8f793141ed6258bb1205e8dbcce986b1bddc2f7b37f578407d542eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\68c8ea0f607d99dbfa850fb0ed8ddf8f5fe29543\index.txt

Filesize
245B

MD5
751dcf05bad2a1e4253fe83f2cab3d47

SHA1
3cc4be6756d3cf6e66c257fdcc1ea9e9622912e4

SHA256
f542cef452f97b6f6b9dc76918919a180089c54c87db148e5445e29bd1a9e956

SHA512
4479c08da2a8e136da3f5ae50da464da0239cd651c65985046431a9b3f00f0157af68a0c6568fb89e01f9443f66e84a85710fbe24a92f0d24ea7daaea499fd19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
94084b0e68e2a480163f60411402271d

SHA1
b64d0d09dc30730165441e69b97d0251775073bc

SHA256
8b3e57f2a55d29a14124afd1346c40117ae4cde6d8915b9b02501dd9cec712eb

SHA512
7a40c66b1f8afc04d32f17894e03038cb62b5c362e1bcba4cab06a861d1ce92f02437650c08ca7bc8c56fbb6d0dde6ee487a71d05564c63e58e42cc867ead36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57acbb.TMP

Filesize
48B

MD5
7c93b883e57773b0fb33297e8a0025ff

SHA1
2b2b8508327fabff239a6387142202a4b17fa414

SHA256
fdcd7a6ce4bfb12de42808d70c9dfd7eb33bd53bab0d48afca2e8f4e6ef7fa25

SHA512
a1d37e8dc3c14c9d3b311b4d9547357c7bb39e478486d261cb6e68cbdffda799b8f416b3228ab3bf31572e3fb7447c362ec31875f7315257a3463469449d7210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
21501db2101450fbec2e96f0a4fd32e0

SHA1
dd15617f02b12de8e263487f8a4a7e5e79ec241c

SHA256
d845c64ab0e73c1fd35e6d1a02696dab5143d1a90d1049c49cffd18d6cd20fed

SHA512
6af6deb67dc4d14af415889b74e9f7b275913f1b675b1cecad7bbd6bc6a4b282cf2802926ac016b8a38cf0f3c70f3dbe33b6175c3684bc072258f5785caafedb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
89ea8404affac817847d43d0ca2fdaa4

SHA1
f185d0124a7a03ade6b40a4693bf3e4b8d231b2a

SHA256
bad7837210330f986379854f2873b5b7ef0a72227a306dea6192541dea12c80f

SHA512
c49b7119ce5af4a3b041a3bbd91aaa4a91c15fc42f114b6597189f996350bf9d1c4d83a7ab70f398fa4ab36a9970a79168ada5899b16e934782f97b178c7a116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6bb023ceba4d9aaa7f11591dd2f5836

SHA1
e917bd1aea0c71ae5fcbb22afc7405cbf552cc28

SHA256
f08e74621299609db109f5c89bd1abd6633b252dbcf82ec3da2e5fcaeb9b84e4

SHA512
e5c106d9081e6461f5cf9dcfadc3dff93d1ef2453489607ba1c3941895fd49dddf3e73cee6065a80339e50355b95663c59f8ccdb7e2ca3441c56fec8bd1f4312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02b3abf51c9e0a8921cc2282555f5164

SHA1
50df6f93e5cb6f41775e6739d14dc07706781065

SHA256
e513f26da962408755ef3e4b6ce0f35bbafc39da6fc259326b17ed2970e71a0b

SHA512
eb00e7713986873d55b8f32dd3f26098dfe79b6951661c72648b690538ebf37b0e8c6e779ed3c6ebb9395f0feca6d6fbe767f27364cee55429857e52a299721f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7aca32d865836038accdc95a6056e049

SHA1
f3646b23ae8c366c5040c29d5ce0fd0093fd1e25

SHA256
a11f4a1bc752ed5a4c39961f11d484d869a779440ab0df8a6352b82b53553d5a

SHA512
56c38d657ed7ad5c42a897550f780bb422412c3805eb4506d47fd11160f432d8fa6811cab4128eeba5f4ef1584041970ed3aa545decd319c33d2d5e6324eda2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af2f2fca57346bd4c77a7a4e14bf8589

SHA1
657bc714637af16367bc5d82d4474252e2453b44

SHA256
faf216e722c700bd063dc6a879d0b7a7cbf87f30fc81b3dc4e120b935368d8de

SHA512
d69a6fe201129a123e36b51a064855ddf1f806c21defb4984dd6aa273067a17193ca07dc02ffe5b42f5c65b9cc26243d344d07a099332203d8335bd6d128a699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7fbbc686f0d006717b29bf79263982ab

SHA1
e6180d109a8add9807025d18b213d341eb123541

SHA256
120c0c69c4d3b84c2ac3011c5554bafe811e29be434062754264d292a73562cf

SHA512
8830cfbb91a6953914c6b9739713e2a2987b5b2a73e73a8be1ae326437dc9841934c941b9b3243d0c12815ebe17237f2f7336b18a8fc5ecbf08fec90a377fa82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
89b7db432f3d821442dea620245ebb8c

SHA1
a5f3df079baaa61e7d0ea6ffefe66a91d994cb35

SHA256
959ad2cf699f32b14dc86008688ca4343a111f94a77d871c0dfdc986ac763c7e

SHA512
8bcdd7f57af8bb050261ecc98165a67cfe7c43a0fdd4080f26b5902663dbf45c8d9ec052cf2e1264d0dbd48545cd7dc3344b258835b8c3a93524dd599f3e66fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e63f13be62d54276bc22907524cdab21

SHA1
07c3220b4304c2d55d20a9dd7a3ffd99a1eea160

SHA256
9108334a115fd4fadae3b7d330454efe8469130080427d3d9dd503cb1e4db757

SHA512
ee7e71ac51b53a58f74171c960cba421a58bfebefe13799a520f94525430361560c86e2dc269a55014073e5e87ec5b314f004f61cd6c3568168be5c33b339d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a0a5.TMP

Filesize
875B

MD5
574f43167cd0c6539bf5e25ee7d3d69c

SHA1
4c9b8662b0b856d86592ffbdbf9b18f0fd1e6ab8

SHA256
b1a365318840f21758870360fb91ad73a1d5ac64833d3b064e779f4909ba6249

SHA512
9402c8de7b3c38b4a4d425e365901699442a82dbd8bc1ed669b86f08f7efbf866c310217a478bda0c9a9d0d24d337dad094bb9f45bf731d830b6b768b90e640f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed9552fb66dcf82825cfa9292ae768b7

SHA1
69d223dcfbf43b627a3ab8edcf6fd4fc92a17e41

SHA256
dcec77069536344d7d440333ad5db0b7624f8bbe038a50dfda67777ea2f90df0

SHA512
d36a1e57878e9ad7590fa27a782a26fd777f0255f99f16486eb8e11f0286a65a1805b30aa794773e7fa3895832bb93507d301968b94f14d4c092aae37144edd2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
2774916f19ef26676200c8bbd639511f

SHA1
d008b742f15bad1f31018769054ee2c7acbb18e9

SHA256
9ed6e20a0f4c6f062f5febd946120b0bcd90c427714b1c9159f5ca438d66e2be

SHA512
5ad8c5a29c526c704cc23152f7e420842e4dfd4f5f1517ca7a5b1bf1952632b25e4bfbb0ba195abf76d42e5eda8f6d54c4aedabe0f72da173f8a71dadfdc47c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
784e5e74a8b100593fee9a7347d50653

SHA1
55789dd7723ab4888da3d26d62975941c251164e

SHA256
6c02d2de8d48d7b1fc19302be2cd17162179a8da9d001c687b6a06d7c6c259b1

SHA512
8ad77d42e135d2a5fada8c439452226d958133b9f161c87460073a34684641c7eb699bab0f45e490daa6382abc25e33ed3c2f4cf60101e22aeb889d82e2361f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
caeb38ff42adbd017d7137b86dcf6530

SHA1
d314deb9fe45801570127462ead8f474e2b3ae64

SHA256
b3abfc61b43c7c5f4d3a8a0d0cb3ba9d2d21318a36d453d2fb186fe92583e99e

SHA512
b38910f86434a904bf11363e822d9adf9fd4537428a7b21a5797a25cb34fb15fe817762dd9debac4ce6140ed94f648a0800d212a3dcf1ea0c6d15237b032c6c4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
8f2cc01674ee7fc089ed766b41233854

SHA1
daf04f974e64521cd1016a996c5a68788137f8b9

SHA256
b9cb4bcb92079eaae840b0f2a324050d508221782f1c38e0ba9f547b8fd6ca47

SHA512
5eb484aa202323e8cbcb24f1caf2ee62a92fe0a3c589cb7254b73e55cc6373af34f489e08bb1d3f57c70675baa98cb12eb7eadd3d6663f6bd63944d54a19b200

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
05b3f60006c2aa99aaea562f9cad2aeb

SHA1
be04310066b336dca5aaa1a6cad39c6e39afc2ac

SHA256
17cbfbae4f72a2a903d007d742e9d46306e930e85717b6a8ae7e6ebedd1d9eea

SHA512
62c383d68c492ec929ecc8c83ed1be90cc999f1ee4e75243ff3e83974bb01e920030e4c0f0ee84ee75000d5945f8bdeb5e61d57026bd9d26d28795d5b4282166

Download Submit