hxxp://wadefamilytree[.]org

Resubmissions

23-07-2024 00:13

240723-ahymvaweke 4

23-07-2024 00:09

240723-afg73swcrb 1

Analysis

max time kernel
183s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://wadefamilytree.org

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1705699165-553239100-4129523827-1000\{BF337B64-0809-43BB-BD02-1AAEFCBB274A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4476	msedge.exe
4476	msedge.exe
4848	identity_helper.exe
4848	identity_helper.exe
2988	msedge.exe
2988	msedge.exe
6696	msedge.exe
6696	msedge.exe
6696	msedge.exe
6696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1520	4476	msedge.exe	84
PID 4476 wrote to memory of 1520	4476	msedge.exe	84
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 3636	4476	msedge.exe	85
PID 4476 wrote to memory of 4580	4476	msedge.exe	86
PID 4476 wrote to memory of 4580	4476	msedge.exe	86
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87
PID 4476 wrote to memory of 4800	4476	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wadefamilytree.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb0b46f8,0x7ff9eb0b4708,0x7ff9eb0b4718
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8404 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8664 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8988 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=9776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9984 /prefetch:1
  2⤵
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:1
  2⤵
  PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9940 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9956 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9612 /prefetch:1
  2⤵
  PID:6748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9604 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9876 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9896 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9980 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9388 /prefetch:1
  2⤵
  PID:7144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9568 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9820 /prefetch:1
  2⤵
  PID:7008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:7016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3682425731322089063,770847816599394068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
20KB

MD5
b3b71ef77841815c899ae8370085d7da

SHA1
f7362b36e1ffecc7f965d4eadf2fbb4cac25d9f6

SHA256
7ad1f40d9814673dc1e07f1517b9b535431fe9b028a6e9eecf650e0be2a03cbc

SHA512
f5c72cce1f7c5d5bc98573339e443e8089ab8c5d9a1826b1faccc3cbacce0011a1192cbdbbd26167b1e435212466bda2c64a9aabcd32b85aef3ea03035f7963d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000075

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
d7aa2b97bc4e4f70d875a8459889adc0

SHA1
a0120c7118a5ae3010df5950406982f6ba5c64e0

SHA256
f9ff9e94bd916f26b20276998ec167cdef480c0c07c2336dc5d9d6abebb9e1a6

SHA512
4ec61854ef508e5a3dab8ebd76e0f2423ff6d6037dd184310289e1184aedaa6fc6cfb59570f2a8551d0a1bc80d193b68beb3ff4dc03946e1212aee52546e1c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bc5010454f110f0a2a9839a09dd86946

SHA1
774fd5f4daa0ace3268ee4dc6eb999bc49306f1a

SHA256
fc9a85097dc09ba75b6bd2477979371aae9b041f652182e68bd6216f9dff26e9

SHA512
e7dfe4db11921b6fbd3d48bab95ba96e1250ed58ed5923699c83b777130b144cd151658283c13bfdc889c0085e428e3d976110e4d1bba54cd199a2ccb6668a99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
f774d52af1c9f442d581d820739327fa

SHA1
e2b5320227679aa31b7411096ec2740f7319382a

SHA256
a252ea81388ffd11a05e78b247de59e075ae1e01e73403b1210b744ca7fd1d71

SHA512
cc41b8edf64f86d1d5d0dc8c83a9333575466c347fbf94847d88dfbcec35bdffb83fd59834e3aca6be1a4c6d1c74640f67a4f09262970e5c840d42e6cf2ee3c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40e1e1f306c63c8ee2fe0d46cb164541

SHA1
5b554b8a2db01667ab9c82f92641c5e08d5ace61

SHA256
832b2e2f19768fb53134ae66f75c4a82cb6a3d9d81129cdb38dda3aa8c02f13a

SHA512
ac81e710fca4663a5cc299fc39c816629eb69c00cad8f045e94aa15fc57a4b61b465cd6e002c4baf266a573d384ed7222f562eee0e5d7611e3eade44a1519ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b9be7e05d09498fd77cd99f75551a055

SHA1
33ff9c84caea3f8336a9cc081469240e3de1c864

SHA256
46448cf773987de40257f86f92386611cf83bb04b8dee6d39d003aef37e8395e

SHA512
30a8b8cfdbee365abae6b0687f86ea5a2e98d6f396110e57394d20301a48d8a00587978b40195ec2ae3ec2bbbb0b35daa1b05e682fc9500135a692df8fa2ac92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cdd4f4f86b86706fa6622c0e7ddc78d9

SHA1
490b9c7f798f007babfa540a5359d9e0eee1270d

SHA256
f30143e3d916f369d3bbf3a78bd005e7ffa617aa96d880b2902f557ce4195aa3

SHA512
037543237274937cced405afe8f916a7a739f0df1cea5a03605a983f498cc6917f07030700ee91f899bc176cb3d6b2714e724bcb06abea93e1458caa49c0b57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b676219c970403c17c580ab0a560d81e

SHA1
c79ac0677feec7252dac3789728d9510fd90403e

SHA256
91001c66c9f2ecd16f3df9a5afade3fe6212dc340a49b46ffc863ab16fc5654e

SHA512
d5287d0681b3136c639e09c404175dbb0bf5cc4f32f9d1a1fab6021a915ab1e51221ba96fafd3c8444770422565dc6f476a888ed1513a588982f23936f706d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
1b1d67b8e6e46c3c56cb59c2d655ea60

SHA1
d66a6a11c1f46c639357122b387379f89aff4669

SHA256
34e21d9bcbc186678b8ade296e10069d00a7a0bbfc53c17561c571069f3079f1

SHA512
b4d708618bdd7251ac0559e41befebae42122ed9ce9dfb52b8cf7b00db08db2e5bdc7a2f93ed954927da9473ad0c30982b481ad9d4c64c986356d9730c900d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29dca079a10016b3caf39eb4c58f646b

SHA1
bc47086c6e0a391295500ff57107ff6a04353bc7

SHA256
354fe9cd44625d99014f9ecc9bfe26f88a57a0ad0781c5eed6c4d9553c749e8b

SHA512
e13c3386fe0b91916deaf2895d9096b017fa17a3133f7686c91d188a7e9a7829bd74ad9f3d38116c71abab8136d536a47e6b643a44aaed1a50d2e1c254955ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
c0d7c36689936d5d427c576304c45685

SHA1
488afd1007e70fbe8b059859aea2e3290eed50a0

SHA256
120eaea58fdfddd408819f194ef4ee0b7ed7d41c085aa375157fd9dab77921e0

SHA512
a09353ac2369356727ff52e3151343691ddc3429f8875ab0ac21df90df711fe9e4203c73349cda62574fc91014b130787e85590152a6a10482f827a9048ee190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7304e540dbdc72fd425ed99e0fe08bd3

SHA1
01dd08baf40d10d4d835dcb7defdc85b774ec2b4

SHA256
fb30880bde33275f30131f4c87fa699e992660294310c793e46cd8f612b2ff05

SHA512
8084710384faaf3daefc3306b9f3b7e955448fc704f23f9edce2140ccf50bd29858e73044149164f158e8896e6df99fea7e36e8fadccc8d6e4c0e5ab4e3f414f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
005d386b232e14fbe4a878fd39e0d0b4

SHA1
bdabec4a113f1cdd205cfac73d56cf823def908d

SHA256
1b97a90c195cf78d966a823abebb965f34dce3a2834e939bb6c02f7d15728d19

SHA512
48df572bf41876e5946900bd68c9faa331d09c0a2c48847c1ada8a69293ff23eb3c573b9b9a410b52d923c0b7879794478a088e7c3ea0451a9756edba6c0b7d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
7058ea16d34ea5cb02993a5eed951537

SHA1
7bd996a45719f620657329646bff75df9e04398b

SHA256
6fc8809782c0c66ac5b2ab4c3e5b4c0a667dfd5d402db08535a197847c45a9fb

SHA512
ec555946e7e4c3fd76121b8fad2ddaf3e65edf2d2bf24aad1ea60d2097fe67f97b52c79dad0252db9854ed8d1035ed6c9d369cab64e1d8ad1ae872a5d79f7ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c8a27675c78394a3f559f895fc355470

SHA1
f3b4756edaa71ac3cf498587a2159d55fb358ccd

SHA256
c498e77a362c3b3c5fe1b47214ea616784ed670b4362209ed1f6d75434b74a5e

SHA512
0819b1dbcce1f489cbad7a8655653e8239970cb895d9d700077f21306aeb28f8292ea494729a1dcbd4ac897504edcafdf44c16678212b02d21e5ec17476c6414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
9ac2a1376208df939f334a33806f68fc

SHA1
1a0c37caf1c4c36bb7e8f18e6fd7a6e1be766053

SHA256
04c54109fa71033818eda1b56c626455b78d54f71bb7ec24c2c0ccb5aba23f9b

SHA512
a273d8aa943b0da9ad5ea9385ba156350baa4790609dec2f14bb7c8d02cf9608cd63157d82b6ece89bc1f94206300015db45f38f63ce7518ef0c71e5756e5603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4c6164184724f40872160f2e743be4cc4d5a7e1b\0fd71393-634d-4dc2-9fdb-03ff94dfad8a\index-dir\the-real-index

Filesize
96B

MD5
fc148a6a8243b8337b61c557b60ce3c3

SHA1
623fddbd6c9301bf98afbbb2b6f09f8dabf182f4

SHA256
a6fd6495408dde5e3516ef3a187d6660ae5843bcfd88dde30e17afb8a456ad3b

SHA512
37500115f7cc9da7792e6f19e57b5fc5ca7c58a19200df18176564f9f86e55c5878322daac86de60d15bee27e7a9fbc24b373324ed40ef35746fba81bbd17185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4c6164184724f40872160f2e743be4cc4d5a7e1b\0fd71393-634d-4dc2-9fdb-03ff94dfad8a\index-dir\the-real-index~RFe5968d2.TMP

Filesize
48B

MD5
6fe78206e7256f1cc5784bdb86e4da26

SHA1
482810e0b25cae2e87d35984313bcfdadbab70fc

SHA256
c97b4950f108571fc35ce6faca5908c3794b62e0f77b8d329a65c2e9ee399f7f

SHA512
90f4185dace6d7a568c341b48290a696bdf03fd6ae698d0c75ac822eb32dc5b07fa52841045f828fd4d6aa89d78b99ece665350e7b09800119f43d8a9a319e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4c6164184724f40872160f2e743be4cc4d5a7e1b\index.txt

Filesize
80B

MD5
167d47e643d9281ba564c44d322f92c8

SHA1
35030cf146999ef796080be786600ee3a7c2bcce

SHA256
e5cddd3cfb30f7a935d46ab3fe85cd94717b454b9b28070980828c757be2fe8e

SHA512
31764c1eaabc501cdeb4fdd57997164c6de2331239cc6649834cba8d3e0228ad240cb09d6b89feb557b165b1f779e17f61dac0080e82e7457c70d250bf092993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4c6164184724f40872160f2e743be4cc4d5a7e1b\index.txt

Filesize
74B

MD5
81543126d54bd945fa88039a7c64560f

SHA1
bc9ce9f59eac4009c901064a625f972fc6168ce1

SHA256
98cc3cbf6da2f1ec721afd39c5c9a9c3c1252c785298d9a88a1a177162b7942a

SHA512
ad5dd28338c33553c553d2dcd88dec638b44b86ff97d18ea2f10f96d26504f1d16796217a74a57c7ae029b4cbb6a260adf493332c30955086d9bba23e6e51e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2e739e5f656d64e370eb8b8bec385c18

SHA1
fb48478ab600a6e4da4a3d90d3c41c129551c1e1

SHA256
075cd9896e8c8b5e044cb31607f341bdabd1ec7227efb0a87b06ba4123db58ea

SHA512
8873bd1993d569ef802d4338e0c9307b6fa3073d682b7ec8033bebf47d6314344464934f8817868132b0bb04e0655bf784ad6023816099179d70205123ef4e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
621e534b72932639f49129fa5be31e68

SHA1
2bb15a591e51fca968bee505c907adce0e71d16b

SHA256
57c9046116be471675795cb8cbbb496df0bc0398349101ce5493c91cd4535a6f

SHA512
78fdbe01028974b077e5e0517d43b3a6dad2882f4cf81e3ae3062f1f4d97f0a3becf6824212b9527b83de5a9e4e23c169b09d10abd7bcd5fb98f843800b92772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
694d44e3c5151d9c6c4442217fa4fc5d

SHA1
972783c23b9c112951990a501dd6154b4f90dfc2

SHA256
41f109116d09517c1fc645092802298184abbe62a48f4324a5978149b169c20a

SHA512
66448c4e2ed6fcf406144cc400758c395d084460c201b2d83174e1a7c22a11db4c600a44037c7a58b891692f27a78f24123a387a23207fcd80940fda9381e5fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c942d1037139b3f01099c427c3a50757

SHA1
d4a353dc16ac84037c38782c27a5a7795f2617a8

SHA256
4efcf6a58cf9b0cf6a17467444b684872a293ffa4e82b2ee07100d91a4f6c04d

SHA512
9cc7436b030b01b03f43c3ad6d34502a3bd7f351079dd8a37ec089ae41ee3b4ee99a7867436b37cfce359aa1427c4954b841d940052987ae3e383efbe932be88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
863534b5c18fa6f379f97870edce41a2

SHA1
c84230775d12833d2da84a9ab55ce616a4701bbf

SHA256
6bf7c6dd0780ac3ad45c25e26bf156dee6cd06d8450a04dfada297e7590441d4

SHA512
e22274bbc7d56e940fd2f5a3444a07b2ec29ad6d3150d9f4ecba71044ad1b75733e4d3f08798e668a6d8b6bc0b83a001b3908744cb70f59aa3988fdb15d4e9bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
3edb6c31aec3e9c51cacc832f49cbabd

SHA1
1e26946bd0f45b7a85320f3592278972b7195000

SHA256
662371e7e0d7704ee190ab0863dd699c5d123c5fcadfe1fe2db2f85494a91fbf

SHA512
a93427e25fb0e235698515698c3e22892a9c2cb2a349c7001f8b8587c4c5d2c3fd9725dbd454eb03ef9426a3be81ece766e85052a57792ad9880ee47e27d57c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
920a65571558413f1b64aeec4ff3682f

SHA1
1334dc8fad413159134be09fbe2c475fe515fa41

SHA256
904a5f71a0d9c612a7619b76f8d4e68cb72ea407f91c6eaf98086207d3f135f8

SHA512
7198585e27087da673d5cc5fc5385f479eeee779fb8d3e9ce897bef8fa3e02e049c9930349547e76bf6749ad35166ca819576a1beb1f5ae1d85ea96b1a0ed0fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584ddd.TMP

Filesize
1KB

MD5
514be542f02cfd6e7f350255ee5c3634

SHA1
9232734082c491c857cad43be14d4edf5072b433

SHA256
d0789ecea5481705c3dea5534f2e473692940c7fba78b6b59af3b3ee6bb75b70

SHA512
510b0c41e6a6e3af68c6e985606d1a5806c06c64bfde3f4dbb8051182050941b24042dcdd1b90e33d60d74ffb573d0d56e87c4d18c469aab935c2a8982ec9f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9aca40b6ae66d09028a252359a96b00

SHA1
6725e1df9e808b4c8c272c1bb0f38a610c474da3

SHA256
9e78b5ddc0dd88f2c9e2aa1010a609c4a91645037cf330ff641298ec1084cca5

SHA512
3817da55fad5f42d14944f838f4918bda4c1ea2b12cf94f89937ac887cba495aa4b1c55e53c308becf839f4bf7b23a9c6dc2bd0436d780ee61319d7e70eba4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d0719fa7-9cd3-4529-beee-f86560ee21d7.tmp

Filesize
11KB

MD5
cf32691ed0939545a0d5d80497875926

SHA1
7db6f72e86ca3718141b5eee276a5f055583072d

SHA256
229d6ab87b0bcb3a16953dae101f195c69be14b6ffeb137d358f6df84c758d79

SHA512
7fc4bcd800d0c0f58ef08dddc6ab68b8929f8837448f1a93b9b2c93a099ea1a09d69f93fc9c83e543303f34e3fb910d59b259747600e4fe89c5286b819d4ef64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
16KB

MD5
694fcb3b87ca765d52eb777b2f22e26f

SHA1
a993204f462a99bb6ea7c969dc3f72a9562bb8ac

SHA256
097e48a3c96a013a93a59b6fa29c329069498c457492e278a44bc090c44c0949

SHA512
b53aee7fa63360b7130db351013da839d9fc41d0f8f58801514c7cf06d61e6ce311ddd372186fa2bf0015575a22de1a858dfbe5296636d03b5a53971716f13bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
20KB

MD5
9d4f17bfb8ec37c18ade9c01c8dc0cba

SHA1
74d1a8c69ccffd3e6a71106d65d7139dc1f499d0

SHA256
ef2683840114bae3060060cb11b4e3889e5cf5709d9e3356a807a4b11c031797

SHA512
a6088b0c8f09a82f22635aab301aca4c1d8c84bd70490fed07b788999962e0f74a14c0a0beb51cbbea10a9385d64a8481d6ae6885de50f425913112928f289d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
18KB

MD5
88c898985f1195272f52b8b5d0ae9005

SHA1
f8206140d2a61a2d7f53d0648e694264bbc2e75f

SHA256
791084b982ff6efb3e72607d131ae0ea6ef532cdf3de9d2343b7de044d03eeac

SHA512
344a4de5a07b30cc7c3481bdd3d0fe1eaabacfe95fb8fddda5f721f10c96d17f33557923648fc2a4746a90f294e3eb182973e885d7155010fb75647ed4fc1591

Download Submit