3d0b905f74e7cd841c49b54c08e55e6d550a4de560508a04c9c9f659887b0fe8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b34274e4bc0a766d539820f190691d_JaffaCakes118.html
Size

141KB
MD5

65b34274e4bc0a766d539820f190691d
SHA1

83c9a1a8a9632af37fac83a8df7cb52ff082dd44
SHA256

3d0b905f74e7cd841c49b54c08e55e6d550a4de560508a04c9c9f659887b0fe8
SHA512

7f5c365ce5acfa2573aca58cb3d439bf5563db13f914d8aed991758fb50413f52ee0cb9440bd740a51598afacb3a6ec7f27085da542909c74540c7b0d00a8d66
SSDEEP

3072:S4Maf8/q84GbwbX1znrVuLsoDyyJURfs3yhucYBYkvwIMKlmKbOmPdAFh5aLzltL:Skf8/q84GbwbX1znrVuLdDyyJURfs3yc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3048	msedge.exe
3048	msedge.exe
212	msedge.exe
212	msedge.exe
5924	identity_helper.exe
5924	identity_helper.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs

Processes:

msedge.exe

pid	process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 212 wrote to memory of 1540	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1540	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3048	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3048	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4680	212	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65b34274e4bc0a766d539820f190691d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1a3646f8,0x7ffb1a364708,0x7ffb1a364718
2⤵
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
2⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
2⤵
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
2⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
2⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
2⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
2⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
2⤵
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
2⤵
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
2⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
2⤵
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8228 /prefetch:1
2⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8460 /prefetch:1
2⤵
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
2⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:5896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
2⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
2⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
2⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8640 /prefetch:1
2⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8104 /prefetch:1
2⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
2⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
2⤵
PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
2⤵
PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
2⤵
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
2⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3060 /prefetch:8
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3060 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:1
2⤵
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9024 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
2⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9188 /prefetch:1
2⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8932 /prefetch:1
2⤵
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
2⤵
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:1
2⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8592 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8840 /prefetch:1
2⤵
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8940 /prefetch:1
2⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
2⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8260 /prefetch:1
2⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
2⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,2940196438015064381,12862375407200701417,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
73KB

MD5
9a39bd88c3300c94351c7103f829e0d9

SHA1
e4a8e83aba92d4b007b2cc15200b94dadba62537

SHA256
e73986c1459aa65d63c210b1b5764c0a79cee7d9877e149dcc2497b72ed060e4

SHA512
55db9234d53b988529478eefe9826a661c0e5a89c1329127bb00a45726d7787cf4aea846f67c074358160dc16461d1aedfff160d724d464ff2f6aa5747f4a228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Filesize
88KB

MD5
c7533caf899607fd9e9212b827c41774

SHA1
3ba8597a385119bb194feb6f57fb05da25996b66

SHA256
a11a5420ed783194be746d979aca7861ab85019cf0983e20aa68b6ccc016ac31

SHA512
5030eab067e4fbd55f7cf892d5e63433280dce517a66fa52a2ff8815fc58d3d69aa0367080931f46bfc6b0f7814567c9ada7d1d97c89c3ef063d444bf63bc694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Filesize
99KB

MD5
010d00a2a40fb61a98ae78559c36504b

SHA1
584b1d1fd5ccd017617cc1d9ec15d4aa66579548

SHA256
7e0a929043216b5a5b9e4f57b9a9e4ad229907bef3686f35855e479f8f5784b6

SHA512
d425e3b496af34078dd8382f6d0a34453a7abaab3e02be95246e00649a78ac8c404aa1252a360cc3e2e1349d7759cf3e46d1b65e6f249912e98bb26d00bbd4d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023
Filesize
137KB

MD5
1b2192daa3b8ee47ae62f645f74c25c0

SHA1
ba3775111447700c4c906545619afb374b6081e2

SHA256
31182235624a4f02964aede9515aa866ea95c4e7614ef604c1c785046ccf5399

SHA512
29fc186b677ad2077cc16ca77242d11bb6ec9fff2d8ed612dbcb7e516e82b4650b7685e11deaf8a7bdfa42d6d0dc4b33cfd1de6103e3f1e3e29021005a109391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034
Filesize
30KB

MD5
757ee4d6eba33bf1ea1e5bd4f6789e9c

SHA1
486a36af9c5c9f305a6065d4048d1cb03b6d9f8d

SHA256
a6530b59e2cc1869b90e555bce3f09c58ea7332afcaab47430508bceb6f1f658

SHA512
e3b790007dfb79509e312f483f509ff41440426c58d4b75cb0d883d7a6f3a89598e2eeac044c60394dc0e4389566d8399d6c9d73cfd5ace55bc4c49e1b1d1936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035
Filesize
38KB

MD5
f26511e2bfdcd51df3a1b7db592b3f99

SHA1
c1456ca8d576ccea6c490fad3f56fe944ac825c2

SHA256
61b5dd78c7ee0c689e19de718ae1e5f8bd84cac7062f2da3c56fa3d13ec896dd

SHA512
f37344f423987095034b3295e54172d10e61275ad45498c96d3a0576e94691e9aa8533558ac6963413d27ef0ed69ff022336c6f8473c58ce458993777bfadd1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038
Filesize
92KB

MD5
6210f49f91ac13f66c2500db044f66be

SHA1
82215d8693d4f4eab48d222a9bb3ffce4466d828

SHA256
7efcb5bace2e73e5f23961f5fe8c5170a14a94ebc99db0f126d0b51a98dad67c

SHA512
45d5ae0dc80ca3656ee1a56c9db4ea504986b8bcdacba46a8538b337e5b61032d7e289b696d4bd0d65aeecbb49d6f34a1aad92329d8166dd66f0fd598c0d01a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039
Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043
Filesize
29KB

MD5
83b3b5729cdff3976db52c51831e96b8

SHA1
d23dc823e37f58e5366340be755730f3fa9a850d

SHA256
675fa88b39008a09994460a93b310a7d4593735009a9b24b6f176c347ad12421

SHA512
4f796f5c25e7a637825470ed1923e525edb98a2d10c1a65bb3a8fb6457c9eb562c61ae82fdfef05ceb49ad7a4140c946e528cf6814b07d79dfbd94df048a577b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053
Filesize
58KB

MD5
b5c980369e70832a83fa075136a3e410

SHA1
ccb5ed2ef9f0cf946561fbc117827e20cd3833ef

SHA256
643902b78f29155254487358382567756d7ac1da2f23cb6730cc0e436f497995

SHA512
613fc347ed1a4d2416f8fee65d704531987a3f9a268d0c7a35e6ff9161907c8cb9cffa8eaf2342b835765294712af4e750e78c486dcab264f991fba0e93b52a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059
Filesize
55KB

MD5
5152f74754dd199c951db0cc6e7381d9

SHA1
24753a97dc44c17973a05b78c1b37e6d70310cb5

SHA256
d49e411b86d1863b60f26aa59a68735807f6ac0df1bb45474ee0296b9bbc4abc

SHA512
387954f57b7036307c368af72f09749147279c3432258e6213786c110055eb78c40cf36ab89ffd69b057dcc0e2503be57913e64906049b21a848786e4b23945b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a
Filesize
101KB

MD5
f3ff17f9e0f9fb70916f5231dc9166df

SHA1
5a594cbc9430cbc1c3be05ca3f49c5caaddb0c15

SHA256
e25e78532181dc42f225db2c060c01d84d6ab8fdd6080ae1550560f0a247767b

SHA512
3d1d98169339f343630d994b38902557fdee02ea06d5703ad952bf8aa0c28c7dc7dde1eb65d473ebba22e1e6f8017ce30dbf03fbeb547e9716dcabae47cae6e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063
Filesize
87KB

MD5
27ebb57ca80d9efd1d7b2bb174af090f

SHA1
527a35fa8eb34124d8bdc9bee973de676977637d

SHA256
866c21d6cada368ff5a8049cb94a899b547fc763068036aacf94be7b24a2a40e

SHA512
230f0a48bcfe8c8552291b9fe4ff3f0a26da2903959478095b906b727ac97f6ee8105403671e58cc323d74ef7208d2cbb6d3f60185d952a0b3565cd1ce3fdd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067
Filesize
87KB

MD5
5da9ea748f871afd777b452f15c71f2f

SHA1
65603d39f5473276cbff6bf6f23e984240ec4f68

SHA256
e485cf8605b5490285c439b818a7123f5855c6a3e831b01046c6dc62718bac88

SHA512
6350082194e694f94d362acc53c21a5fa747d62834c56529f1901c3234a91510e0930cd559a0096461f2deb59c78b59c9c1878165fb30daa0af71d7554b2b5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000075
Filesize
43KB

MD5
703d66b80a4aa54d811b370456103e06

SHA1
4e08db275979df9006e7ffaa5a408134d4ef3c0f

SHA256
876063b10afa8a33036aba868bc25248cb3af2cb1806fc410ffb6d2b155a0873

SHA512
9b13fa45b80a4eacb8832fe4d83d909e1e4d6f5e4bc2539647ae81db26d862a01c4807ac54a9fc71553ec96a04de9a83d1502effcc521d271e2ac7d87153c0a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000086
Filesize
1024KB

MD5
ee1a01036b95e8cd203a29582397d0e2

SHA1
c56f50bacfa725fff83a02c7f09038ca323e5a6b

SHA256
da203745e391dbf6a990d527e026ea600323dbe4d73f6e94a67c3a2c1dc3fe1a

SHA512
19f478ffaa9302b9a69a74d418ef5b7a537ef4468c43031d9118e584a95b3d4ef52c536efff2dd7cc71958630ba9a25f95cfb7ef1c5b0317d7d36fdb5194f3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000df
Filesize
51KB

MD5
ce0b7447df1a89d6fc01caf25e223c78

SHA1
0eafa34a474989de8aa3ac73ad958832ac0a7826

SHA256
5f3e16b0f5105a380bf1ad18d825b30bccfda690e17d67a35004f63292c8cafb

SHA512
c1a06f0510bdc45623e31778b4dd2d3e1674e6fb1f16db695c4b2156f9e536056a6d11c0421a06ea2cfbe50c59bbbc9a05ee717d80ba8c37be1a1c80485a46f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e0
Filesize
38KB

MD5
c00caf1d029855dd94529571b30c44bc

SHA1
648452c261efcd0c32255bcff7778aa3a1a667b7

SHA256
f932dee939fde6d1129fb88c166d9f1e733fa1aa249dcdcc50e81a2a67dba026

SHA512
3f5184583ce9b4af73a4d6425bb53e48224377ceb0f67b037f7e55a654ac206fd385b077ba8e82ad18444b791742b2cd9b3955be1362ba82c59fdd5692c4f80a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ec13ea0763b19ee_0
Filesize
336KB

MD5
55131b7a46994551ee84cab5e89bb154

SHA1
f3132a277d8656fbd8121737b085a4d8f471f250

SHA256
09c7a2cc4f1e9bd22314f84bf85713e861049c3a85d220659ab6b5f165d3dd66

SHA512
5bf53515f9dd16c469d441320cbca019b22d34124456ac52222f3c226dfe107fe5f2e656b70d529f0bc7bec4fb75c75caa31c8c2d92356669f5e9fa2d7d0c82a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c799814cb2c2de1a_0
Filesize
263B

MD5
e20a7af4faa4ec7a927965dce21f5c3f

SHA1
729fc6c9918e71c5b4bba1a2d91f87c38d1c54d1

SHA256
47abba13be99ef47d118da8f2ec268e47d445fd9b7a3874bef6e66fed5b4a2e4

SHA512
d4c93c8bdb8379b2baf290c9d21daae70d1a6848428a1b826952a761ed46c8dd59c90a62cb289643172ce8f790dc47311ffd4307502eb8fcc53c80c3c21d5785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
30e750518167ed3a85f4f7df30481c35

SHA1
c0d4502c610d65aa79c33dfe559acc5e6fc374e1

SHA256
1c4a9c839ae13754d5544077398d16b74be505abf1bc8aade69e15d0b6fa8d4b

SHA512
cd1c591a6d1f5b47716757cdebff68479c223c728728fe324e5da72034fe775a14bcc2aa9e8ea4aaa0cec964d1641eaaf5a53f30ec8d5b25eb341db7211f3fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
365719e12883f394d502f80774fc8773

SHA1
d657070504c2028e514ce2ee0772298500c93600

SHA256
f18838608c9c07d224a916aa017d9acb345ecef604cc7c92fff97d955b5f0ce3

SHA512
13a9e184befd90d47ab1091e328c8f2e6f9ec7f42696d2e881330031717eabf0652e5d66bb7ca199c82e006a05012cb4537431e1dd797c25e3e7a941d5e30930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
64ca414d97dfb21b802adf91967fe72e

SHA1
dc21e293304249de0c4faa2f5bc28f0e821574b0

SHA256
ed8e81e633164d6114206761353ca55d9325bddbb360e92a6da2c35b7451895e

SHA512
90ceb8f62569c399eded5236acfec34cb9c2d3aea8b0d75596a849e45c8f4a7623aa753a166248730016de98060e8ef27238372206d91712b6bd5f56b976972f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7bc76e039969dba701a9a72647766bd2

SHA1
435a644232db303a7c055fdbd17bd7c8abf0a9e7

SHA256
1e6ab154ca418ee9f14929f63eceed089d2dd4006a760833c3f8211df5c0ced3

SHA512
206d01a5538d24d31930521ad1d0fd3375e3bb8a25584fad4b0a54a33997a9806e843972a88148626bcd22bf1db6cf9d0851bef0cc68389c7bb4c98bea8f5aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7954342d339caec332d93894a2417548

SHA1
4fd523b1b45bbba75fbb9d87931a18b3ec5b6991

SHA256
6ff319ce8d7e44590365750ea1b37739cd017710801442c4d1fe338ddd0b7640

SHA512
b4dbb181ad413110a4f2f25dea7a50d95efd8d72302014257e181ba9d76272c1f966a7e009704f509e4915dd6be9c055db8aa096d81db1f5257a85e16d4a4314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
96d8be43960645f5fa1baa9bdee93231

SHA1
86332dc860c2f48cab0ad9ceeb9556f3b3382c1b

SHA256
94697f39d13a088b7eda54f5b2043705d8a16fc165fb653041baf2588f103508

SHA512
369b9d18415b971e1f745cbccaa42140f98f10b211ff52e0188aa5d93e6c436e8df73de7b3e153caee6469e20cb30e0d55ea1a6004ffbca0fd10d305b3eff623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
49f8398c6920e390aa00892bce2d41c9

SHA1
b91849c7558c83e827072f2920cd954873a8f8bb

SHA256
47fd97c9d9a84751730d2a02621747626ee57992fbd9762bf36ace988800977e

SHA512
90510a817c04b7aa3529e25ec75749b7bfad1df2af7e545cd95594d063dcb77339a5dec92d0f229a729a866be837913b9df320a3a94137c493854f9bc57c63cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
aa47f520c6a46aa13bcfd7231e50c469

SHA1
81fcab0318e99fefac1fd64433247f4c1b2a848b

SHA256
18cb2a6e66bbe2b5f932dba21e1d5f0d89ddd658b3c9a3eafa7732ec1694370f

SHA512
b7be4468a2bd4e21accb08ea07296301fe4dd81e02fc229034212cd110803ff25c496744e6cd0c02b8c91c164c66242822066499681efc3c7bd2e6c4a4081944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
1b61eb83cc457c22119695e623c35956

SHA1
7b733c11e761b0b620266f450c1350fd11f2d6f8

SHA256
bbfb3698064f72c6832690d7d42db309bdd4b1ae0711a43dea7ba3b1891dbc90

SHA512
beb3dd3cd62bd8d05a4c275a279528ab9342b37f9406bed4c58382c9da2d4d072699d9fc29fda1ddde6e3dec71bbd640b232825b9f2d719916bbac80f4362712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
98cb824ee1af0f70b02803040ed1d2d1

SHA1
9f3c7045884a68c048a432dde93a00e6d8d787c8

SHA256
3c6d3d66de6164c2a2a43c142b22e75d96e183d68e22d36e95d40141020bac43

SHA512
40dae15a728b97d5d3fb7b816c035abd29fd005f7b5676a295f7e43740b65c71aa3ca081f5fb4f5aba42fd477c6890d8f191858755a30a2c0aa750e11ff875b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b16e.TMP
Filesize
538B

MD5
3fc82d9ad568012ed0e61166eb121ba3

SHA1
48c52c66904636d19b770d1fd4f68a71e8aca977

SHA256
c6db1af6373899f7757988f52dea46a8c625320893f63dbbb5c6104515a50abe

SHA512
f9cd9960fb8cea922b4b15e4db22b79bd8cd0eedb0b1ab68a2c2b27d3f6762e65282a3f88ca55eac8fd3ccd4fa82aa2570f5b8cfbb3a0650646e95a0f79e7c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e5d9dc4c0ef754b92639e74f5d179493

SHA1
703352795f9220677bba2d97f5601c14b6e5189e

SHA256
a033eea96f1087b950bf7c8e1f1223d90681e7ef4f716d3ef08f7d16074fe53c

SHA512
feb3dce552b42e80616dd5d4d2688a4ae8e5470be0ac483f2f9bdecd46d88f6b6803a1c08fcbcdbb78f14dd288d52e6e7a91a48f7c860df715847d38825da6b1

Download Submit
\??\pipe\LOCAL\crashpad_212_WRMHOUSEAKZQWZJG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit