338e20d2de2d43bc339486baaf857c7ab469db6701e7a287c2197a402d212ea3

Resubmissions

20/07/2024, 05:13

240720-fwl4vsxfrj 5

20/07/2024, 05:10

240720-ftxsksxfln 6

Analysis

max time kernel
281s
max time network
283s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20/07/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f.html
Size

694KB
MD5

18a8a0569bde7afd867d45738a773c03
SHA1

b6cb2a5e96461ba5f009bd5878b42c40c878c9dc
SHA256

338e20d2de2d43bc339486baaf857c7ab469db6701e7a287c2197a402d212ea3
SHA512

f3a682052dfce3bec5f5bc7b0000e65eb25934443dd8e4e0602576a9178c7c543d97b21cb4e072a72dacdb95c95271ca3fe71486a983c7764e84e817c2728cc0
SSDEEP

6144:d5ZSlLmetxgpDGPJ3c7dEzR+W81TVznYaEjdwI:2txqdVzYaEjdwI

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\GPU	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3007718528"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31119985"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost\ = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost\NumberOfSubdomains = "0"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	TextInputHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-514081398-208714212-3319599467-1000\{828971CD-D94F-40FA-816E-AE908C694969}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\ = "0"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CRLs	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	TextInputHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-514081398-208714212-3319599467-1000\{86342DA6-3431-42D4-8BE6-F1F3BCDF905D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\MuiCache	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CTLs	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\NumberOfSubdomains = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\NumberOfSubdomains = "1"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\Certificates	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CTLs	TextInputHost.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3028	WINWORD.EXE
3028	WINWORD.EXE
2384	TextInputHost.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3368	msedge.exe
3368	msedge.exe
4528	msedge.exe
4528	msedge.exe
4992	identity_helper.exe
4992	identity_helper.exe
1868	msedge.exe
1868	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
4172	msedge.exe
4172	msedge.exe
1944	msedge.exe
1944	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
1452	msedge.exe
1452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4216	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4216	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3332	MiniSearchHost.exe
3028	WINWORD.EXE
3028	WINWORD.EXE
3028	WINWORD.EXE
3028	WINWORD.EXE
3028	WINWORD.EXE
3028	WINWORD.EXE
3028	WINWORD.EXE
3028	WINWORD.EXE
1112	SystemSettingsAdminFlows.exe
2384	TextInputHost.exe
2384	TextInputHost.exe
2384	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4952	3368	msedge.exe	78
PID 3368 wrote to memory of 4952	3368	msedge.exe	78
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 4412	3368	msedge.exe	79
PID 3368 wrote to memory of 3400	3368	msedge.exe	80
PID 3368 wrote to memory of 3400	3368	msedge.exe	80
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81
PID 3368 wrote to memory of 2060	3368	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8992a3cb8,0x7ff8992a3cc8,0x7ff8992a3cd8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,10599439166578589315,12383269955961630123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5024

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:784

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:5048

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\OpenSkip.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1000

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2064

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOnDeveloperFeatures DeveloperUnlock
1⤵
- Suspicious use of SetWindowsHookEx
PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8992a3cb8,0x7ff8992a3cc8,0x7ff8992a3cd8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,6639836467944689528,4498397640954250985,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\CompleteStep.gif
1⤵
- Modifies Internet Explorer settings
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0f062e1807aca2379b4e5a1e7ffbda8

SHA1
076c2f58dfb70eefb6800df6398b7bf34771c82d

SHA256
f80debea5c7924a92b923901cd2f2355086fe0ce4be21e575d3d130cd05957ca

SHA512
24ae4ec0c734ef1e1227a25b8d8c4262b583de1101f2c9b336ac67d0ce9b3de08f2b5d44b0b2da5396860034ff02d401ad739261200ae032daa4f5085c6d669e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d150b7e3ad7d629eaf029ed7a2a540c8

SHA1
5fb2c69af3c4b6762a1ddf448e4ddf6af8557df5

SHA256
f73217349f2da63ca7be7854ed9ef0e95fca5fc8b843d520e80d4104ca0a04ab

SHA512
3eb6fe5a38b4a1cba3fbc43b89cf9ab27c679575d24abff6cc3635bbc716a4d7b4fbf15a395b2d06870fa6152b3f47c56c804cd6228ff4839d4e33fce8b15b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
40608d8f1a86d11fcc2341aa6fb1a71b

SHA1
0a3834563058a2967a6b110729936eba7bd5d358

SHA256
00f35ca1461907287517ccfe92b1288eb6431340545a5dca6fb787fd1280551e

SHA512
19173367bed2b887f60d701d6ea42aef081ede4114e9c582d466830034ec34f84dc6a251ca94bf8a5f0beeedae41a9f88b6cf25078ea439d5f45bafb442f0bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f3725d32588dca62fb31e116345b5eb

SHA1
0229732ae5923f45de70e234bae88023521a9611

SHA256
b81d7e414b2b2d039d3901709a7b8d2f2f27133833ecf80488ba16991ce81140

SHA512
31bacf4f376c5bad364889a16f8ac61e5881c8e45b610cc0c21aa88453644524525fd4ccf85a87f73c0565c072af857e33acffbbca952df92fedddd21f169325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a7

Filesize
22KB

MD5
9196e81f8ed7f223d765423c1f9bc8a7

SHA1
88f9d5c2a6908cf36b8daae803578ca9e1fd2929

SHA256
a4e2bcf7ef3c6c614c2142d3c1fd44caac4eafa86a1779ac31cba164e2d89cbe

SHA512
e7d23866fcac017762d2e2f18597124e9147f458d30038f78ba9f3a2bcbe479fe4792573894370ce2d6f93a00401231d9f01955fde351ff982a82ba87a8241f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b0

Filesize
35KB

MD5
5009982b60a0f93eac4c1728e5ca17e2

SHA1
c0f932d333b91a4b971a52ce88bc96320745064f

SHA256
2ffc0ec332938cbce14008ab246c3d918800189aece932e92bedd8adb8332fe8

SHA512
401dd0a45c177130628787b92a17642783d27b1a977833af4110d81cbf2572a159a371beb473baa07ad38ac8297551aadadd2ebb80401a73acd580fdc03964aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b5

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b9

Filesize
40KB

MD5
b786554392ab690a37b2fc6c5af02b05

SHA1
e7347fa27240868174f080d1c5ab177feca6bd84

SHA256
ebe47cc89c62447316148809bda9095bd07bd5392a99ab4b8ac8b9f6764cda51

SHA512
b71cdb76464a775fca909cabd0a7435c34de3ee4e19c40f5bebba6415295f0be2f82532a2ecda043c787ea4e8c23fd4e582a4d4322923fdf603a56e3fcb8b567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000cc

Filesize
51KB

MD5
f206f8337a187dc42199ff6772838d22

SHA1
cb3f334350c77fc705d9dc3db778dc1b4a03af0a

SHA256
40163312d820a039fbdd57dfe4de9036a06c844474c845f357451706b7a20f2e

SHA512
97666a93f1a12426dff44c283ce0fb3da390a557ed53d02d5c79387b346d2f2bf77d0ab89c7d138848bf268330391119d9f1c8ea5032a93486c53c913af0a651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000cd

Filesize
21KB

MD5
7dbd5dca202b651abea7db3d092712f3

SHA1
cfefa958e9cc089a5355b73145f8bc834a00552c

SHA256
16c7b582088cd626101f338070c7046b3fe902a4ffa0069651392314584a4b46

SHA512
eb9ccaafa365a2965ac92a9b34a065913825aca5fa1dd8db772a97fa5928bbc5bc80ff6b536d66f523ad7f0f5304ddab861e0e5d1f19ee7f2b633ce4b41d9c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000da

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e9ec23a1cb2d2415005a5e5e120cf220

SHA1
9f6516dafa80f5252974afcdc3321bedef472c21

SHA256
fc3d695c7289bf4df1991b40fc5d755a4df69bfdb17e2e369c24b37bba5c3257

SHA512
a45061f6fa4d133da750fa81197061a985bf98e89732f33fb879f95ae9789ec5a9c187e6f7358a74369773aa02bc3d5268ebfbbdbeba7fb107e5887f34f00c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
9fec77658a6961f433052d3089a07247

SHA1
4ad24075afb2d1fa9292ae735006b0a667e107b8

SHA256
879e52ddb3bd6cbe32e9f6241fd3d2801a7870d1afcce75aaa5cd8aa8ccce0f8

SHA512
015db5082e945dbdf534d3dd507a0fc08bd8923108a3f05e451a9481b322f242923dcb53382b869a361189d70743aa8b0ef62e89a0a75ab9d8f73eeb7af7ae34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
7cad287608c8f1356ee8ab3cf898a205

SHA1
4c55e13a03a295898305ac9d26c4d3302b2e001c

SHA256
9eb87e8c305d30c88ea6a848ca93f5cdfe1eb3a22a71b38b0f6d37f56ba25a85

SHA512
bee01d7cb00fdafa8bdd6fc5be54a7ec55478709139f89592a74a493aad9f7a3693e13e60240c28e03cf3f804057572d5d1de0ba8ddf0b016db1d735389ad255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
48KB

MD5
e5d6d887514c69efdcea4c80ab195136

SHA1
2c55e58af3971f909950fcebe39f16850ecb4182

SHA256
d611edf13a4d264498d15da1b60574087537682c85f6a318b87eb496157d0254

SHA512
d80e16c89db65accba559c0c2e516b8a2ac241c7411c76a0d14e59893c2c5db31ae892f742f229d623990f4dadfb53b80f680caeb1b38b1651672e1b798401fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
352775145cc9943f30d3b65eb861f59b

SHA1
40b06f9084d408e7e4727694d3edc1831dcf21c1

SHA256
5a9f724396abfc9a8d36983a334942fbebf239a325191eb7d5a40d92de874c76

SHA512
9fa512bf6b35d2b4f57ec9075dba976746b975cdcb6085c3f6f68b6a6884214d7b21daa55facdd5806d0c0218b8181b48249dfdf50be16964edda18490375b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
23bc2767b6de33a24b27d5db6e0d25fc

SHA1
a0bf6affce36c1297c95024cd4c1bb4578596f40

SHA256
f6fbf06d1bb80069e785fcff536fd3b65c7cab6758f3bddaffc0326b0013ff8c

SHA512
e8666eff80be06992a1e0ddfe1eb753a5fa83e974a8ec8f13464195fd001737eb243e54f77e0433c94996778773952c04fe0b4312bb2f3ed16de8630a34ef3cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
136KB

MD5
a1fe79dc81b1e4dee6f14fb6e0c84b0e

SHA1
841f30c0f4f698d4915fc122a5941d29d863cae1

SHA256
604e097c4261e590c4838b5ac2ac41b6c8810fef75eb63f346e491ab2519efff

SHA512
61badd61700d864682c14234f89a5c960f2a275db896a9d11803ce69f1357f32dd6fb1ba708cb0641fd1588ad0169b9a08af52b599e57406b1f004cf825e9058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
19KB

MD5
1c084328e6e4de3496d917d5ac3925f0

SHA1
2c5dcd1950ebb4f62aff33b9a28a91f2815cb57b

SHA256
41e86af70060554e5d651d4435dabf66d0199ebba3ec4e9c91940c6845c9cbb0

SHA512
079196cd02bcfcec0d769ec53a90ada66201cf57b147b35a2e40623eeb2b65d48762811e3a932ceca272fdf4619928eea5cb768d824f401221e58cbaa3afdc76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.fandom.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.xbox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Filesize
46KB

MD5
19f66c378d5555528aaca3a95b26bc54

SHA1
40453849600e415a4ef7246cbe6bcc0de4de04ce

SHA256
12bf5222ee3ace1e70b2282ea2e19cc2b85a71140e89c4e2ce5d995a71cb10b1

SHA512
3d51844b010159192d085b71f56ec25c5ef9a6aca8ef537917b6ce54e96b62cb983f1fb06fccbfac9bbc5c2dd343ccb06fb5f3d321b1bae90299854997654570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
21115f4ff74b2c5230011bafe0f3b80e

SHA1
e40d1ee9407888f66e64c40c7dc452a93ee0c0f7

SHA256
4f4ca3956ef5c6b590c37fd827787caf34611ef2c3e4e5bcfc7e6afc04ffed6c

SHA512
3ca83f597066718c25f52e613029411b487382c6e92e5f07b9f3a822df1b589c35229da72f54c405431a1561d1b30efb30b64243ebe066512c1e1141a49f0714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c401a53f0901b8511cba282339d1ad28

SHA1
323bade6e7beb9c654eb563d10d00a203c9d0c0d

SHA256
b6fa5dc64c782dbfecbe37f2632fd3862ccf26a9d4810b5a7dc780f2a2af501f

SHA512
a1ce8a8547c5cfd7b9f0eed0c09f1a82197be4fee995e09cf57675b562e5b33e01fc6e73afc74b827c9bb855e531c6be53c16d065193aa6dcb2aa0da58acd863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
fbd11aad9dcaeffcbc8543d67183cab9

SHA1
999e49d0df4454d93e5946948ca8e20018a37ca5

SHA256
c28c8c0c1bc583dbfeb3c79b0e282b55030814f9c5756e3b9bf6930cb2beb4e3

SHA512
121c660b93cb5e994c5883c7985925ee0c0b31a4dc6182c80f3503c4dbcaed2036e937fe20d8a248b769f03a4a052560991d682a96076d782ebd15d7b7316d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b61a9e0c1204ec35d342283ffdc2d03c

SHA1
eb718c0eb79d63851acf3c135ad33108ae1f6aa7

SHA256
445a07d43f8325842aad09ec213a26481837838b9b3fb8c741bbdd8c166ad815

SHA512
413ac895c8491f94217e8cafa3512b642a8fd47f3a9c6825e13c2a74eb4dd36cea50ea7a1eae67ef799d0389b4923d9c5bd42bb038947cae7864bb0df51dcdae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1e849c568dda3c60d9f1df4bb16e428

SHA1
538d9afb2d53b2e51a522fa62b81bd6aed5513d7

SHA256
a0df801b1b703f5e3b725aa18bb8d25b83658b633ac9b56bf026a2178488b849

SHA512
86ae1b04101aa24d48ef650b76fafe5e274fbda0895ea4150c5bfd35787b9ab7ccc53962ff8abcb76113d0033a65bcf534b7899e2c92cfb0a45e35c127556eee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d0db5fa7b0a5fc5773b0cbbdb8f90d07

SHA1
55f0f5c1fe87af66f52ce6434a2412bc2d63f6c8

SHA256
5d138f2e0f654f27f9706142a720faf0e8920e6db5e053e59f4b3b98a7e0238f

SHA512
4a00a3e6df4d1fc76ef195f36fed856c46a8194b05d3dc185607267cda4fd2316952e8b5161db74ed8e25e09566d1e9db9bf173b36fffb2e42859368ce86a0b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d11cfe71ef50f8a53e11529c031f7945

SHA1
322668dbd269aeba85d62a3aaa15e31714865e60

SHA256
69ca95255ee6887bbe2d12db71681b9e8c56fba0998ad21ffe773a0e2135e8f9

SHA512
b1811e5105cc051cbe9e4bba331d43cd0ea23b3df89992aa6b75d394143667a5747397ef87051676906efbc183f4d117d5d2b5f82d38e99a35fd0f6ef229cd89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b275082051651a1f89d3a086f0689b81

SHA1
50794072b12e3da24eeaa04a29e8b4611b40e552

SHA256
7b639be38f553b5dd8a45eec4bb6b7dfaec49b03c1bcb85190511e5ea30a95b1

SHA512
0a2952ce0af1e2a69471f195938d8df2479c5f28e5868a4e127dbba7b5cf4710aa1b86896d81b3c09037c18c092b14cd72ac30c6dd281970c22bc712d7490bd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
05eb6c0bef74fc997cbed22243568bef

SHA1
53b0112582ad5f619e649eed8757231fd608302b

SHA256
6272c16f4ad0c54ce890d44e2076d1749a67ce9340020e7ec485565e05d81fce

SHA512
1cf466bd46900e90b8e11ac7518337b945b5bd611523ad5cb38508586e11861603f8cc1a770a5ab243855d38bbfef0da63ddf9eb36e355042b582ee9d7b14eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2e271d0eea87a18c22da28bd7aaa4c3d

SHA1
dc0f684b682c1f03dc2f8f652ee55e5374d67dc8

SHA256
dcabfbe0b5e0a1456b3cfbd6845e3efee71e917e76a4814ae8bab9209d153c69

SHA512
65947d2b7c775820b7ff15cafbb7b6acbfb8e42f231304c733cbe43333f69923d3f15213193fff38abed0c97547330e085d01560ccf39c3825eba41bfe360c73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0d47df21cdafabae781559340c8bc449

SHA1
ecc42b6ec469285212344e5348d3357bb7379852

SHA256
c8cc7e18dc44196e9687b920ec32eaf27314c090ad0f1d5e64468b1f23599722

SHA512
44dc445ea60b1ca6aa344040a70afd15437733a6ae4776cce747e5378785a185fcc2ea459c29534958e8fcdbb3ce3336870e1de70e3d9cae27515b4eb3a787b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
499c3308a79c66dab7d32df6ad8f3c71

SHA1
04ee47e59a6076335f2c97f0844489c656e667fa

SHA256
efde5b2ac4755cc2675626ad69bd7b1b567c660487731d421788d800f3819cb8

SHA512
703397891aa5c0f042adda735fbc680a45025258c7fcd69492b92d7251e77d0b41368b9919413dce1f4b690da480ddf2b39e2bbf0ee80d41d2b5f9679c4dacf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2ef45b718363fc61eaf4c76c5023e032

SHA1
f54d6855d8989aeb2a2b0893a95651312321a865

SHA256
96cbd38895d9e110c5c18fdb324b1fdf8fab2ee423433abc0b03f014bb5d1603

SHA512
354ba54b9264fb30a209a7fe396fd197f243f81420f6d660d27afa057a0c9431d1e681b8710e5c0ab34b0933e7f2816cc8ab11cbd7815fd7f486c7d57595e108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
06cbbe37ffec913e44b5f94a370a5198

SHA1
ff0a7408141cae4eb955ab01f62d953be08ec8b1

SHA256
6a8e194a0d42e21d807a38827efe054e526d20f3772b7369a70ab1c8c58a94a4

SHA512
ebd8035d42ea2437d13acda78926f96b50a2b2234f66339e226d6e3cf7f37a6e8135ecd07941fba7379ec62422cfcadf77809c99f4e8ddb3636344f3e8024352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f3860be0b933e86061b0058e412e97fa

SHA1
f0f99b5976c11f2f5a12e3c79baae499f8c58bb1

SHA256
1c5b940bbc00c8f3bb2cfd823aada9c20a52acb3a7761b8e08f9c01f95a949df

SHA512
a32b30b70b0cdaaebdf575dea1327629a1988a801d4d32b5c9dab1f77767f84ee388c70f0f2a0268c26f8ef319a5295bc04554388136a2fb3aa3de405d038ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bf8374d6b32f2d092d10286b33248b2b

SHA1
612b58def0af237b86c60a985f8aa721b2d91e37

SHA256
04cec3dc0f7f38faa7a87373359017f48189c51aca71f2e22ca8d6d0e9dfb121

SHA512
d5f42e62f1838b68bb36c14613ca13b6ce7176a93cfe16a7e9f28fac76dbce85e14df0675efd588cc77299855867cae6e60719d22182a97981b05bb0a689a2c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13365926023232399

Filesize
50KB

MD5
64d638a831192976af9f66f3afa6ec32

SHA1
78af64626c75433a224d54c9cf0ad7cca8789e36

SHA256
842057f954cd458a8a03ea165d3c505639fb6776b3aa115c0a1745f9eef8d069

SHA512
6ebcde6c992cd26dab7ef59151728449825a6b4c549279620f69217d0de0ed140c4caa480f0190f9442b34c2ce0a62e3520052864354dcb50a82aff773e5280b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
316B

MD5
a499f47f627f852531d2aacbd9cb6b57

SHA1
1d808c20084c697ac1eac7d2a016d607324daeb3

SHA256
eaa4edf6cbace8b81025042510755bbd72ac7ebc1752ba65c77c6b761a55b38b

SHA512
deb5658230802920400c747f2d8b7519ba8613ceee5cd28e94604e09a6c9ce866c85901412a9dc39e717f7d9f2b4da2b0d8db05b46690a9623fc55ff30cbed3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
ed0c08993dfc9edb4e07055b9ea237b3

SHA1
e487ee1d329fb000672a3740118f6f491be5ce79

SHA256
a6e3988e13aa07ea623def3963296a3e62b054965ad96c3260f5a3ccb9bd47c3

SHA512
08ddfdaea5d0d66abda94488055a3b217d91eea94ad56e171fba8a37b0b5e0f8b58e55397a371953b6f11d177b9ae6192bb392816fa9901893aaf5170870e7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
7db566a6773f0965e284131fdb1ff491

SHA1
47d9d75d1a211a9cd9c134d6461edbd6243d0c16

SHA256
c98f28c51970232ecd21569aaf222d5c1fd19c63ed64a360a7479b4c20842cbf

SHA512
a1385b167b7b160b21171379ec91c22b4e5515617c82e134022905e914cb74d0350186d6b46f72e815bb17120ab14868582fb4755e5ca1af5a37f06083409a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
280f56c5b673cde7d20ea4300c8353c2

SHA1
89b6bee0b1402899daa2ccd87588e9d63b05b930

SHA256
cb7e785acfb3046c8a867e20770f22006dbbdd1456f4728b952fa732344eb6ec

SHA512
fd11017d0e36e23902a395cd4993c4cfcb7d1804bd54f9ea0a646cd74d40174bb9d50f32e18baf5790c3f285afd2633efd05443ca2c2fd23c91f8c6096244240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cfb6e925948fa2649a59145a5816426d

SHA1
eb237d08aa875a35523e08410c32ec51341f9e3b

SHA256
8c960f1ea460973305ab255c325530cef8e7e47ae1daa47e1ff6e3d171b37369

SHA512
b6adf532ddbf2ce60155c12fd193ba1ef435f1023aa98800e3afbee0c5ba33fb66507720d2e9356ed7225cff6c2e356282f076909818aedb7a9767bdf147593b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
fc1bc33f2e7a4ded37e58e0e8816b714

SHA1
2f5d43df161ffc785e1f3c4cdc5be3c6a26d82ef

SHA256
4572570f3f81f9fe875f2af3a77b9c312c560d4f23c7acfbb9e388d251c66f0b

SHA512
bdd7e466c5a906a5aac323789d0468bba280275aeb49027cb2ac51d0fa355d29a8f01952e761de44b8c4d408aee1dfdb37be0e339571c2b2053923238561aff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
24a24ddde8de510b79eff61725fceb84

SHA1
cf58b151ac08e0ea8a56084b97e7312eeb7c2bdd

SHA256
82615611801339701f8c88094e6af809cfe4368369ee8a13b14ba422d5fee176

SHA512
d617b046fbde8f85739358ed65d6df769398c5381fd8621d8e04b11204b31264abe0ffb5ddb62813724d22c485c3b2cbbe86cdb037dc1b61e068b3e9aa0ed11c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
60a03b3d232b0eee5b67981ad1da64a5

SHA1
50c5fe4715600bce2bbb5f7195019cc7d72e94a7

SHA256
5b04840e8062876dbf4ac8697a13c9a2cd3403399513605cafa1475c7e523c56

SHA512
86763729b286540949a2dc9019345f81865274fa8f9f39b5c0aaed290cf9d7f989a4f9adc6738baa3bb758725dc318682a80b1a724bc1c49dfae27b017e1b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
93eb13a9e3ad56dc0fff75746c06ac15

SHA1
1b1b132c7f7e947917f4a66fef7c670f3a8c2819

SHA256
a47394f42b2cb55389cb354c4e0f7964f8ac537b97c248a27177fab55e75ed62

SHA512
177b9133ae6670a7f38cbbdbccdc9f8cc3c6891f0476a97e23a23ac41fb09dfb721c562324447d5ca78b6c6e7bfc9de00d388ea828df8fd8a41e77b5f24e30b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e531daf5ba6313bc10b7edc5c695811d

SHA1
962aaf3fd07ad39082c64ab628da9c42987c0a2c

SHA256
9b3fbde658c6b1a2b8c7003fdfbf49fff67732da84e90816ad865b671dcaf74a

SHA512
881e138a6c9c8330069f2b3f7e31f57c7798bc687183eb1df7f9a8706e71c72a8c9f48b44d81cc62be98d2b3d3689677ec4b4486a15aded4b592d6afdbbf2ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
301446f831f2c274cc4c07d1edc0f0e3

SHA1
58b79887ca061d37b865945a6b66cbd88690a6ea

SHA256
4e082a742f9eb842a523bcc3828c1a2b75c6681c96932821fb0ee96c12e6655a

SHA512
7eebf06da5e7bf721cbd1f6aa8a4b9fc8ffefddd4be7411ee5e6707520379f85a70eb454ac92deb55bd46c1f7afb8c9f9b16ab84c723318263ddcfe56e1e3211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c582df64afc9c836ce4745aae78cf43c

SHA1
cd8665506ccbe1112f2d79d2baaa5f3e0c0289ef

SHA256
c2950fb470f25902dda9cd2aba6ecafd1bb3bd98503ac75db0bbd41291ffd3a4

SHA512
5a8c55346a4c11056d39712ca872cce01cbd2ae424bd1102340d8bd617185527f239aebb3550bb4d9a3feef48dd15780b0420a928d1c0296e264ec52c5a5110c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587049.TMP

Filesize
370B

MD5
04566495ca53d3d1f900b8aeca789ed7

SHA1
19ea37cfcd94def8be9bf192912d74855d09cb28

SHA256
e47ada981394f164b86f8c1a2d35e7fa731b4c8a99de0bee6831cb27611f11a1

SHA512
73e5d4b055c5104da99bcae9a923d76cbd939d5fd66db3f3bc93201a6453031fe18bb1626da0757c1f5a632bd16c936d37f66dec352141b42f129193f8ac3dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
a634adaadfac464d3958aca115686644

SHA1
b2ec97ced01ec01eb1b181ce8f2a587d6e7a4ed7

SHA256
1feae02b34127b671fb9a83e5f7ebc5dc8e3afef8c97e7766832cd67f77fc773

SHA512
c01aeaad65b44180a3925ea24ada63e0ce6ba39829cb1c64ad2157b1e15a988d486a0aaef461308902240e86d4b625c7191fdc7593aa004b71f001f7c4606872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
8ddc1982b76f02dda00902c23545582a

SHA1
a89058661a32778d29367424370d5e4161cbd213

SHA256
65843646b2a1d7318caace20ebecb8fddcad684768bf21cfb5bf9f700191c274

SHA512
319ea852e0ad69696e3a688639721f8bf71255bc5159f99c88bf612c029379f48333f4c5f81e3b1b4bd89b47939aba29033768bbc4eadb0fbcf6f5bb5cb1bb0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2f2a9b7-d4cb-4ebb-9ee5-a2744e0da6b3.tmp

Filesize
8KB

MD5
77a10171bc15800ac5f538c4119ef019

SHA1
35f39c1c055bebee78cc6c6b454c8757fae7314e

SHA256
87eec6a94b1161d5af86cce63888e3504a44ee08f69ab4df562525291b8a844d

SHA512
f7a595b7d91abcd78a98144db678a4032699c9844d96d3daf1009ace6262aa9445c47d6b7d5e82ed78b749353640fb7e22658dd30b42a09e5869ceb97d2ecba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
144KB

MD5
023216d6851a22835d6b5c04f495f208

SHA1
a2b927e2612726b1ed044409517c70ec1101e006

SHA256
e943b81f87caa9801d523fc31f649a8f072b022b59c969c14c7ab8b74cc8ab3d

SHA512
942d1dc01bf0b88be8402b85a2d020e052b4cfabcd84af68d97f96e825b8063fc491b065707cd6fa32efa79d74b61fa3a67e7947d07270eca0f7f9cc59ee1c1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
19B

MD5
0407b455f23e3655661ba46a574cfca4

SHA1
855cb7cc8eac30458b4207614d046cb09ee3a591

SHA256
ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7

SHA512
3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
3c57aa664f15a34688442b6df532bb03

SHA1
ccc981547bb2fccc180151440c66d707e7eb87c7

SHA256
8499d24e413acbe0a80e3328ef2deb9f04338f602a59cc1da541e22a57cdff84

SHA512
cbc8711b12a7baaa4b67f42adccd374a9c6253a3e9ad081fd92167ccabcdce4f732794a6956eaf284dab539c8b404edf4bcfbb742ac6297d4b3117e63a487ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
5e4d75891b40c22697062218b1b87909

SHA1
d357d7ac8ea2fda8c51ed4afa7cf9132cd185c5d

SHA256
96ba90626c057eeedf26106fe5e72b58314d1824e923da9b83bcaa45a673fcd7

SHA512
6357cfd41c282b08840c514bebd1ffcc600412381483d0dc8e8687d627b82761678039f1d1d1467965e7231301a130e6939cc99d3aba3ac0e38475bc128d408c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
cdde9a46d727abba2717366d6bd72ab0

SHA1
7f73e629e6ab92b59fa25a35ca9818db37c004a6

SHA256
e8f41dbbec41df8d040d4da55fbfbb87ee134d1c242a485c6cfffbaff062d352

SHA512
dde0421215bbb9e1a092934765cf36439f3d1aa0e86485467074b1b5d159deb5d0af635590b58f812c9e5776708fbfad65afe61dd1de4313ae4990e5a6a77437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f24d54bbdca00b4b51676cc4eeb57bc

SHA1
8fcf6846a5baa0fbeecbfeb69bd096337ab36cbe

SHA256
06ed8f1e2fab86e33fb52b8b46a2d01ab1ba997c995a84364318a8eff194852f

SHA512
4ea8aeedaacd89a914961cfb6c0ec995e908b833a35d7cf22db57f3f27c94e795ab5beb910c4650755fa87a7ce814c2851844799b82d0e1c54afd5bd5a3d8735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c707e61363f32e03f0f175d618735ab

SHA1
0e1596b7f0343917f2969ae78a0d3c4801bd1f10

SHA256
85d9d6245ca09327e745f0cad2d42528f4a4d5858f472acfd1571c2598c2268f

SHA512
928c43b7093ff76a65253a178d5fc65dc067eee78013c0a4e46b1ea6a96e0586801a26f14226d13e6314c1b5c43b5f98f1c8852da2b056b36479e2ddcf1e72d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1d352e583918d7fb28fe20adc0e9fd4

SHA1
e2a4a5f7cca85fe95630106d34deb85271a35073

SHA256
e500e63f3898e8b9fa48c8f690ec7a10031cec9189e431aad3cee964f2bd6e66

SHA512
570b267593d53f68eac6e7d4b92804540fd3861c99b9d64f07f60d6b7576f0468bab277e67ba60bd84635fbdfa2cc5a79c5d6996c2ca3e520f0a9932c8c99059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
15fe9b8044c86a598d946699be9b5baa

SHA1
677000a1170a751e2d186474f9ef921b9d3d5833

SHA256
b32e1b1f7f932bbf13788de83ce091a5cbf4c617436241921ee00d00a3d9bca5

SHA512
8d9069dfa31b7be542b15923b20399d287ec2a78dbd03471bb75ef1f2ac8efc4cfe8bba669ae37354b131e2af929d775d9c2716ce7f6b363fb99c5b6dbdcf128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-7-20.515.5048.1.odl

Filesize
706B

MD5
0cf332195bb79f02a17fc481378c8c5f

SHA1
0c0ebd97d3e27d02c9f911dcfb8d72de118740fe

SHA256
aa6fdac057753c710bc2ebfa657620bc9b8568f00bc86ce903492a6fe3fd8206

SHA512
d3ec666c4964a03cae0e04e7f8169b5308dec287b9de6ea7bb1e094398b4b5c8253741c0942a7c8d135921c77ba16446ee8fbbdedd255dd8c9826d9ba10e3852

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.21xzn261rafwircj8p_dfvhae.tmp

Filesize
1KB

MD5
4085b7b25606706f1a1ad9a88211a9b7

SHA1
31019f39a5e0bf2b1aa9fe5dda31856b30e963cc

SHA256
b64efcb638291c1e1c132ed5636afbb198031cee44384f3ecf67d82b73accecc

SHA512
9537559523839e3e708feabe8c04f40236add7d200ec36bad00c10a69337a15001103c17093dcc0d8cadb4713d911f39a6411624c1db4cbf1ea1af272a716168

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.eqzpinzljh_ey35riilj0koqb.tmp

Filesize
9KB

MD5
24ebdb1228a1818eee374bc8794869b7

SHA1
79fc3adb42a5d7ee12ff6729ef5f7a81e563cd2d

SHA256
92a7d7d3b0bfac458ddcef07afcdad3646653ba7f4ad048fdd7a5ec673235923

SHA512
63764d99a0118fac409327d5bf70f2aa9b31caf5277c4bc1e595016a50c524cd6c3d67924321b0fcad12cd968de1a62bd292151e35fd907034efd0f40b743d6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.x32a26o_s5hxu49xc2pkrk96c.tmp

Filesize
2KB

MD5
530f1945913c81b38450c5a468428ee6

SHA1
0c6d47f5376342002ffdbc9a26ebec22c48dca37

SHA256
4112d529734d33abda74478c199f6ddc5098767e69214a00d80f23d2ea7291ff

SHA512
3906427ffb8f2dfea76ba9bb8cac6bd7dece3ebee7e94ea92da5bbdb55d8859c41260a2bda4e84fab7e1fb857ad12a2e286694ea64d00d0aa6cab200fbbf64f0

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
2aaa4134481f6d4ef6b44658d489618a

SHA1
a30f020b4ea91f8bb2875813b2e8036a679e74c1

SHA256
56ffdcba29a25e206349d6f8805f3c8559d7b2eab82475e6b8fc6316c02aa964

SHA512
f4ffae089eaacfc819103dca1c330995b90ab797d3b2e9403da909691cda4cdcea2ba7b97046cd14c84c44bddc6ee565303b9dd4273dd1444224a343d4591b45

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
341B

MD5
76f21568becb022d40ca4712b6ae16ea

SHA1
5cc78bec292b182cd40527fa09a7e36e478b6652

SHA256
3903b8949c28131816de75c34cea7ab9fb0ef197b6bbfc12603466c1a2c41f84

SHA512
45c85bd0a6ed8722370f71959f6af82352028dbe50d9bd296a8dfefe211387be6c23caf829c7d023abd0a226797c9a50a8b6a150fbc1760bd1363f0bf932c1a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/3028-1528-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1569-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1570-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1568-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1524-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1527-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1526-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1567-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1525-0x00007FF868430000-0x00007FF868440000-memory.dmp

Filesize
64KB

Download
memory/3028-1529-0x00007FF865890000-0x00007FF8658A0000-memory.dmp

Filesize
64KB

Download
memory/3028-1530-0x00007FF865890000-0x00007FF8658A0000-memory.dmp

Filesize
64KB

Download