hxxp://asf | Triage

Resubmissions

22/05/2024, 23:05

240522-22ykqsce26 1

22/05/2024, 23:02

22/05/2024, 22:56

22/05/2024, 22:53

22/05/2024, 22:49

22/05/2024, 22:46

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://asf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{84BA4314-97FC-409B-9985-AA5F28A76747}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
2020	msedge.exe
2020	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
5900	msedge.exe
5900	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5672	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1184	2020	msedge.exe	83
PID 2020 wrote to memory of 1184	2020	msedge.exe	83
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 3052	2020	msedge.exe	84
PID 2020 wrote to memory of 4380	2020	msedge.exe	85
PID 2020 wrote to memory of 4380	2020	msedge.exe	85
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86
PID 2020 wrote to memory of 2540	2020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://asf
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1a3646f8,0x7ffb1a364708,0x7ffb1a364718
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6500 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8900214086310821736,6938788680850505772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
40KB

MD5
9dc9673c5af1dcf765ad951ecba52c69

SHA1
9d5c1202e46a7d699bf85559b0a827bfc3a57751

SHA256
bd993164fb521b40693bef84eab25d964ddf89b16788458e661e453eb418da46

SHA512
bf515983dc980667844bb4a30b05400ef01df2047496335ca2770466bfe8a2170a4dd822fc56bb109b6235ace7e4ff52a75957d2d9a752c3bdd8b71265b698e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
69KB

MD5
aac57f6f587f163486628b8860aa3637

SHA1
b1b51e14672caae2361f0e2c54b72d1107cfce54

SHA256
0cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486

SHA512
0622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.2MB

MD5
1697e7a82ed549b1fc21b2c26649a1e9

SHA1
e749a0188a76490dcaa100ed461362927ae8e127

SHA256
ddd55f508a01efa588bcb5097b6d7de823c500442675887949c9965210fce66e

SHA512
affe7abc48559448e9d7ee7c119bcbb94a6a5daf8cf5c1703669575af5be214422eb7ab6daac6d15b41af81a78772fa5b53ced323045cc4b2516fc9b43370531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
33KB

MD5
3cd0f2f60ab620c7be0c2c3dbf2cda97

SHA1
47fad82bfa9a32d578c0c84aed2840c55bd27bfb

SHA256
29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

SHA512
ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
329KB

MD5
f413b02d13acf9e6b81ea01cbf191611

SHA1
5203f545b21157007a55dca331f1ee0339b3bc95

SHA256
e1623ce34246c5a2df97d2e86ee4b51884fc332655745a7905a84d2f849a79cc

SHA512
42bc7d3a3726083de5ebfcc134c37e591c1b12aab5d9000f361520c9b92c8f9c022ed0d31f2b3eee29420b2f0b493dbaec3cc353564000228ae57f3d84a67705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
64KB

MD5
0d195dd38e9406c75882ba90cb063949

SHA1
117557761105bcfcc3f49c5d6312ce8bd382d2b4

SHA256
e7f8740f6058aa21acb34e453bae47d0749fcfb578d8f2ca15c48fec85f2191e

SHA512
99aa204b190bcda69cd9a5b812f27b5b3f5ad30583e34baac713fc23f51eca18e8bfba490fa3c40f31911ee4b337d01c0f3e8278479c99fe76020ce630365524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
4411e45751e63d855c203dc6b1116d17

SHA1
a842d9bd6f97f6bbea4201c8e475b1fe3a2b9eda

SHA256
daeb0c7be99c95eb546155f28edb1b3f580e4dc217bafac36e122299d35163e1

SHA512
a6db68c59efcc790317119606ceeedc68d7d389341af8e86ccbb6ec003c05d2b18c6f679f7eacb627149b1f16a56189a4bcec0de895a3122e96b5e375c74d103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6886951835e3f51e4359931fa3be8406

SHA1
aced3df358cf10aa51ec5b559bfe756d5f35e218

SHA256
3005093d9dbffe7c5f91c3ea5a1f72da09d3977ba87ed0007b78a79451be9d3c

SHA512
7099ac0bdd85a40436125d7230797db6d0deb765071e55702a1a82ecb8981d941d497332964efd20e96cf436a5d30ae9b06011336e018e50a9b4cbfa8d753ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d4de79281731b2c53266b85063cc6490

SHA1
3772e478bb28aab27b0fb2784d0399fd10fcf898

SHA256
33e7231c014f801e7aca3449942e8d52b3605548a447f10c03d033ab6c4eb93a

SHA512
49ef232d0f6b1def9a9cfa0e7747152913af1dd9fb1a45f773bef0868de6d2e51a6c3e1cf5cdd6c8f1fcc4457139419a68ed96d73400e6f0747c5a48277a993f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
44b671ffbb88fc1366e13c2b2c9f96e1

SHA1
f869b0cf6a7801b6fc9db74e1b6ee10e9571ba72

SHA256
7a070bc6517c4956a1d80cff16b831c8543ce8401dbcbcd9ae399dced661c559

SHA512
2b99a58d61a6accc69be91dcfa6b9093ce8b2756c55c6c8b37652cfb725c05d786c8e9bda6d2b700b51f92fa9e4b47254a01ef5bb840b91d93f1e2d2af7ad223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6716f0775d14b48b776b6521f1edc738

SHA1
28548797e516dfec66c3df5f9df121b967ee75ca

SHA256
48f73fb39d739c15ee4613c7f56b4a517e6486d2cc3fa03892f65fad437c63cb

SHA512
8a3db594d81c158099f155673e3765657e34fe2f973a5a31fc9e0fc54694b277ed171bf768386b9b6f19c5d9f5e304c4b78ef1f950c24e8a2f8e26347a27db33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c9a56450f6b3dffaff7da754c4d45b0

SHA1
7940f45d6760a9e6aca8033391f1d3a098c76d1d

SHA256
3e98056c93c54ec576dd044a9b612d4950f693a969add5e8533a04cf922fd549

SHA512
fd9e729b4596d085b50a75042e7ab3d881f244f26e45c452a0560fe872553903ef6db12cdcc5ef8dc4cffce1958323b3f9449e4a79893418d1de9e20dc612946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a0cedee5156caeb74e93fd282880b16e

SHA1
6d03dbfd5604bfb4079dc747e88855169e23f255

SHA256
ac1eac4f13fcf55ad89477bef3831bf863e89ec2f1ac596e298106443e837dab

SHA512
a0b0a126872e7b687304a2527408f3583ec06736e240177d86502cac0f61495dec12f43bf4ff746058babd94ced135722f5573de13cc639c8dab86c1836eab46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4286a979d73366fe2eb354218388dc1a

SHA1
9283f812e3aeb4eec79d092b5bbbe7f36493f483

SHA256
6a427aff0edb7c3b166991e62e13aee63db560b49189f787d8cff3873fc44a2d

SHA512
d6b664976bc5e72c57a610f9b4848a1bf1a1a2f455e3f79c03b3d2d8e9fb75f98c909325614b449dbb5db210252e7f9634ccbcfbb6c5385df994a47014d5e3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2eda0ad3d8cf521dcfbbc5729edc5a17

SHA1
f11dd4ccb6064aa5257671b20ce99861198b8358

SHA256
2926d860926714d8e2cdd423752c32d235ac1cea87b69c83ced57fab17659351

SHA512
def86bf4b4b09ad82d24c11ab361fd62868e525077e51bfa85ab64ac6bdfb7e0f3d81ef28f2a40cd597ee69eb80a0e583c159d8154dcac06e62f7d0fec8c140a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
77c815859cffbe3d96e1c9d25fdc1932

SHA1
02200de1fa34c2d94ae7b6349d11985042d57924

SHA256
aca43f467f3b808a63f597bf3b6d2a7b3372cd94c4e0be144cb835afd39b71b2

SHA512
b1bc8ff4c4f4e90e78ba80cca8070ed1542c5276a883e9f1d5336dfdb9e175acc3420b45a8acf5e1ae939229fa5297fa1cc4a6f037844b5a5a70ce3a0061ad7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9d22761d0a25e49f9999dcbb1f002069

SHA1
675e6f45510ddff71736ecbb20e3dd91ea678a0a

SHA256
299e5e4732394a732e4179c546707ef12de01d7c7894fbcbd75d89261bfe7cd7

SHA512
14c935490202e1285a41aea386d8bbbd3a4fe53704bc5ee297b75ed23f7497ddcd22389c0f376e438ff510351a5bd2673b5c534521a53f624329def498a96359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25edc8e5eecd6e7fc6f99d967847b53e

SHA1
5fd1fdaef216da1070739071fa3e84fc08464d2b

SHA256
45573532150a0264e2c7c0ef3a2a7582e4ac86cbd8633dd8952725a4ea14a035

SHA512
a047ec1aaa4b98900e0956d6d72251315010ca758c541f1c7f3e554995e1fce67480a8f12b08a74abe49acd165ae98630456705c92b94f93326b19e52bb936bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e6b4d6ee6c74d2aa7eee1580717e200d

SHA1
96863f2e2bb2aaafd04a5a0cc7c8f8762c750c0f

SHA256
31befb9b8a6f9986031490bd535d5f308391e9284779c54de63195927f9bb544

SHA512
766163062791b3debbf09782956098df7d2cccc08ae448809f28280c50ff892149f5f35d78c0424002f50c35a9db45400f05815912338d815a0010805f402d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd23fd3b0f1ea896af433b1cacdbf5db

SHA1
aaaedcc18adfc88b7722928cff9bcacf3c82c81d

SHA256
41c5f3ade00e1f48f8adc71b55c33e8387b9a0eb0f0e942c389f40235740a4a6

SHA512
63f2b02139ae73c9f0435c80cff096f251ef1abafeb14c7621e981d2cfc52e19b069b1fb58192f2e22c7b9ab740c3291e732302e58d1ddf9122000b1b1860cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4be46d9fa7de7e69f5e7e629aa9828c6

SHA1
5be1f236469b09589c81d514010e30c7baee39d8

SHA256
c4e41b132c7039291adfecaf4e291e9fc8ccae2970dae3dc349e37beaeee17a4

SHA512
73c8a40502a74a613e46b15072cf6dec6892d49e5621980f1b8de7a16c93488f2584c3be716672447bf1beb1bc92efd4e9019d742d7ac98c23d14e5d19981d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cae1.TMP

Filesize
1KB

MD5
336c75e9ab675e81120740159c36a696

SHA1
6c15e195ae6a90a7e057ed592cb8c7c0d6264709

SHA256
3dc65d9271738854b64fca7c7c1adf35084ec89383598469ccb56bbd6209daee

SHA512
9418230f4d9a22d73af80cb08b2a002c6901d290a4a854075598b0a955873dace41cc442a5ef04c6e7fe8b56923ed9f981323bc36191ab85c6056191bdf0250a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
59621b2557c22062fdd8a1d156b60a8a

SHA1
c4e0b23891b0405fd12c313e2f2de63519b3a4b9

SHA256
39229bd2044d6f37aa3f9157972df461a65454daeea9a1a992e5efb543e574ba

SHA512
481e3ae4e26868795c2a2eb3e6ebab5dc330be7c07fd6d811ad18455532f888e385a35ccd5ba675b0fbb1b5656392d096e367cc0f8aeb8980fb109241b8eb89d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
2e1be81474689371b909c2b149b18be7

SHA1
a73e217ab87b17fa75e6a326d8c3d572d76181c5

SHA256
6de1f817880376dad13ae0b1985b85e713c3c8d5cec4b6bfbc93c7ec1d89a736

SHA512
575ec108cc2567e8abc5ddce39b9ceda93c38fcc458e52f1115caa8717a28b07d89aba2dddc223375d5dbaa549055555d36fec45e6ba1b66d6aa0486cacde1d3

Download Submit