hxxps://github[.]com/0rbianta/WannaCry/blob/master/WannaCry[.]EXE

Analysis

max time kernel
299s
max time network
294s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-08-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/0rbianta/WannaCry/blob/master/WannaCry.EXE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272559161-3282441186-401869126-1000\{5FD10875-94DE-4566-BE11-058A54A0FD43}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
2904	msedge.exe
2904	msedge.exe
4512	identity_helper.exe
4512	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4732	2904	msedge.exe	80
PID 2904 wrote to memory of 4732	2904	msedge.exe	80
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3460	2904	msedge.exe	82
PID 2904 wrote to memory of 3328	2904	msedge.exe	83
PID 2904 wrote to memory of 3328	2904	msedge.exe	83
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84
PID 2904 wrote to memory of 2316	2904	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/0rbianta/WannaCry/blob/master/WannaCry.EXE
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b9123cb8,0x7ff8b9123cc8,0x7ff8b9123cd8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1244 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3216 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1888,10543158395526369353,3415173176225932820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
41KB

MD5
ed3c7f5755bf251bd20441f4dc65f5bf

SHA1
3919a57831d103837e0cc158182ac10b903942c5

SHA256
55cbb893756192704a23a400bf8f874e29c0feee435f8831af9cbe975d0ef85d

SHA512
c79460ded439678b6ebf2def675cbc5f15068b9ea4b19263439c3cca4fa1083dc278149cde85f551cd2ffc2c77fd1dc193200c683fc1c3cdac254e533df84f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
1.2MB

MD5
027a77a637cb439865b2008d68867e99

SHA1
ba448ff5be0d69dbe0889237693371f4f0a2425e

SHA256
6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd

SHA512
66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
73KB

MD5
cf604c923aae437f0acb62820b25d0fd

SHA1
84db753fe8494a397246ccd18b3bb47a6830bc98

SHA256
e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4

SHA512
754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
69KB

MD5
d91bac1b60b58c54f87f1d1b7b16d445

SHA1
9ed78d3cf7553e3180bcbcd2ea9779e1e1a141e1

SHA256
4dd5f57067798bd3132643930620ccde1e4140289d52fcbc4fcf7b252876fe8f

SHA512
eb474a57cce34e17d00972b927846f087c55a76f5fc1fdbea0e43111f9d9a5af848862984431402a6a043e5a1a96815be84e114fc03c0372a03285fcf0c2623c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
43KB

MD5
5ba77a4d6647a96613ac2b5f989d9d41

SHA1
0307028d3862ab2affee2e1429a0b259c7661beb

SHA256
68f74a3aadda9b79a48214612b47a9504d6da9fb820cb5bf5c95b4379c3d626f

SHA512
5b763115e9bc115897096d36a2e40d2f440962afe919793cb01a5444f7d9352ae0c3cea9e6fd1547de7f722d646ab1d8c74d0f6ce5576f2785a169cfffeecf93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
1.2MB

MD5
c03474c91a7d5b52f22924609663e304

SHA1
95c2a641c92a3dde1e8d805c9200e9bdd322913e

SHA256
842a7c2e9da0be07dacfdd0c018ca1904792eb9e79b3651e99a39a33d85a9f90

SHA512
710ebce90fd5776270451e3d3fa18d1ced1350c74904e71c436f0183285baefffd686e89e525af3c1ac3a054ea1a33fbefeb6c9c2b81c92d66dcb9ec8889ca6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
36KB

MD5
d736af3ceb9ce011fc9086ca749e426c

SHA1
4764c7c197311772d7c449372c60f152b396ff7d

SHA256
d708cb3bd8af7781b0ea968c3ebd4d032df771bde1a3b91d29130054acda1913

SHA512
baff3b9e05187173ff4fc13393fe789a7d37690c28e31ae26c773df330d4db92eef51ce8559df3cf583bd554b83523c4c88f51946bf48b1fd20aeb9f23b6c41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
42KB

MD5
cc64bf8a400ada9dbbe06511ed38d2d2

SHA1
10a4363733e724478d679ec4d0e5c66a6980e963

SHA256
d6efbc34336fefd6c5e74be83bc294b4ab27da43aff9f69a5b2154c7ee72d3aa

SHA512
b056e334d9d6ff2358a60f0e8b95fd4ffe20e4b9e9e0e21968afa0c41c0492abd3b2c2cfc90f315154ce49344ce3781cbd060a3aee8760afa1970ee2d8b96c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03bfd52d18703eda_0

Filesize
2KB

MD5
7a5e721f3607028dfaa0f1fca939951d

SHA1
34f1c4c1bc24d58bb6d0cd0b1d45e57dd234ad31

SHA256
9060308c5e35aa9b8226983ab56434ad491334d11e3cce2cba7bc052ba15e5d8

SHA512
0f7c44648d4c659e44f2d6376c4ebaf95897f4fe04331c5ddfea75b2bb41b45b2d5feea859c467fb41c29d628971a35eeb0d9f94979b960417b3933c7ec2da32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0cc3f1d33211aadd_0

Filesize
3KB

MD5
196bac5d709e0a6af57f215e0b2f12e5

SHA1
82c7dde5ddd1ac7847c41356b6a64a0f835b7860

SHA256
068522b1cb20a5305419bb02cea5d15a9d4d1b7ddee29b4c3f21a79cf473c165

SHA512
c8cdbdd9ce3c49c76d18e75346ed762d9639520a0dbe924ff60e866f1216688882ed693ccf42393e295f65ad1ba6a000f2e1a68396d231e58699b77ad3bd7983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b342244409a7f5b_0

Filesize
1KB

MD5
3de6a1fd4d020ba1777829372ebd3a71

SHA1
c041ceeb3d61d5fcfad6c4025ed550f536951f43

SHA256
9e80bad61d9068ab4c54b0d29efaf6b6d2564fd5ba5e2b0d72c04adfedf34798

SHA512
91221229e5f502bb2f8b24a1bde0ddeda707ee094f1adfef7a118ee36330b8b1cc08c53d65bd4f2d37d37d1a538e5611ffd094a3128e3720bb0a9de288f1dad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\256aa39a0b7a1025_0

Filesize
3KB

MD5
1817b02ff3f253b0c4d098dc7ec24e0c

SHA1
8ba1b6de1677539a537df58f7aa7fa41dcef839e

SHA256
02da7a2b556c7eadb80b38034a0ad6b25ee92614b3dbd006cf0b7aebd7f7336d

SHA512
61047db71a806575e36e62190cee8c320416242fb37b34b2c7531a1b40916ecc42c384e4065b075f5b7aae544acb00b2874381e1681a4cec598ebc8071ad5636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26069886e990cc46_0

Filesize
3KB

MD5
37f385d42f17d8a557a55ca1babe57d3

SHA1
4e761b1451aac2cacf3921ac51e2827503a5a9a2

SHA256
a4c1609ccdcd57bae7e23570379017ac6f75b400977dd13006f28e61d080b8e1

SHA512
2b6b60ed28e27d8471e388f62902e8900dc45ddae687a26e1e4201bf4b903cf6d4a104c7c6a4e201e5c9a2adbf76eb82a1611c54d09b37811281b1feb0fd35d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2767bfe0cf3e382d_0

Filesize
7KB

MD5
fc9284395934dae0d18ef42e148ba976

SHA1
75ece2575123c2a5d00a58f3f436e88a1c48ea34

SHA256
42ea94f9b48dcdf2757d95be3d3ac52c25b02e30babf2118da94a3b0668d211d

SHA512
f0623636975955e9902ad7bb9563084530579cb029608587fa1f47396dfcd683f966e174dfb717b50218be8774dccd826cc76f90ba9916a1225e72aa3367408d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2b0f1f57b276bf39_0

Filesize
6KB

MD5
725d2c34e61447b80509d91ddb9df3d4

SHA1
d482b1bbb61be971f5b26b6c4884aa32a9ffc636

SHA256
f52d9b58bec68a87e54e1ea5b23760aa0e72aa58131006bc37a4623ca5b3d0dd

SHA512
f7abfb7b0be1546507420f81d3edaa3439bb4475e99e589b04be8e314037ade2d82d6e66742ce0ea9014b4bfcae91be182eb4eed4c75dfc351b32c25f3890ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d44dca25c7deb36_0

Filesize
4KB

MD5
26bebaa6553a6277647b1c71da718196

SHA1
55c0eee091127aae2bc71cf075dbc764b168f8db

SHA256
ae02a1557a05bf3a0b36606a03893dd8df15714ad88c5dc14f8ce9194fe00515

SHA512
0446e304e0ead0515301b21e9fd3ebebda97edfe8fb7637a0ceabc76515b83d0d8ec5f3f6449b8f1aab3516da587d4ee8478f8b8b782b0d7cb183a469d86ff7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e4447cf5fbee8ed_0

Filesize
4KB

MD5
c1d6f3e79e5d8cd3ca5be444ae2ac93e

SHA1
9f667f0b3cae7c623ae159975e2116de08d1fef4

SHA256
9e8a0dd4dbd6c9f65117fd4ae10c7f560ed5a497dc4fc425d2aa588de374915d

SHA512
fd7f81c8916ab6934e1fb4d6fb99a735a2db5373a4ef76f834754b12204c06175730181f69af75abf278b4593d084683f3b12f8ca62abd8c69f687901a363099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f9424cccc041251_0

Filesize
2KB

MD5
eb10a987ae872713617f35de98cc8a10

SHA1
270f3f6afa2d868e5c80fcc92f825ce7a2874c65

SHA256
08e7a08f4a90e15ebaaed0c853140b5c6a37bc553f3a9b992b9f420de9af9319

SHA512
201b2d83f6a83fbbb18e4d1a64b481bb7f7862c76bcf4f72bc999b05588b1ef6abb3730e41127ddb16b9bbdcff73e36bfeb6bb6d27891137f51560825a26431c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3552e3a94b35b185_0

Filesize
2KB

MD5
9fd6433c61532af6756b800328f58737

SHA1
9040413e3d8a88e035ff32ff5dc9f6d2f3f1ad5d

SHA256
c2d6ef8d132d7d2224d546b12448e627295cd6dad5433d9ce96d984d4e09eea8

SHA512
68489394ead92f4a6992c81aa9e960ffb2ec5a98740b0654c7f76844b5983446eb951cda4105a5d667c2f536e1a80c8441f6a40c5b09a723bf924c1acc68a647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b3e0ce13da94924_0

Filesize
1KB

MD5
f84d7f15df1e899e15e0d7203c831696

SHA1
6a0c8fd08b5d107d650ca933cc51cda666bf3df5

SHA256
02a5ea28682d1f09924396b1c7e484cf3bc3976a7b71350d16e48f373190308a

SHA512
b55ff3f0cfc1b8b8b9b55dd64c93eb8bd634ebf4054bc64fc5398d51113c091bcb4eeb882ab399a8bcabf35f6f65551a85691dc5b2409d32cef7ccbbff61c048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\437445634e270822_0

Filesize
262B

MD5
3441e65d8eb29680235a838166ba3295

SHA1
329aa9f4a3cd2841681c2c35b6eed18193efe6c3

SHA256
704e15ffa33002c6d5c820de50e97d8e0739e5f2ca916074b85b1e0c3c72bf7d

SHA512
be3a7159b03d7eb8dac7bb98bedad4e5c67840844fc4283743d30d497842f042cdb294999a912a76feece6caa2eb5be4f9df2703cfc5da38f2e7dd3da78cf0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\451170c3a768578d_0

Filesize
2KB

MD5
1e14d5a084bf801571e2dca2426e1f49

SHA1
ab93b7562b058b6c3dbaa201772095c4d14cacea

SHA256
02f8af34be1853255a9b394beeae9527e01bf829449b37a8027401883baba484

SHA512
8b53e1378c7ca69b197524e8301e1c38ae876c48ee5c29fe1ef8747b3ed2db4f6e43971c437acd1d7a2695de770f723fad91da704ada99177a83cc2f33e45eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\472a4b711e1e1690_0

Filesize
9KB

MD5
0b948a28fab0003e33308b013280e768

SHA1
93353bc36becafcd232dd7b295540d4f7cc99cb1

SHA256
8da710c64a94b989c067804412e27c81666676a4a643a977f627ccd016268b3c

SHA512
acc4a9b0dc293c04d264c4cfc03ef1343378faebd573759befff8c59a88218acff9f87686c3221b4bf87990e4a9029305b0dc7bf5d3c435f67f0bc85ece9717a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4f530995e5875099_0

Filesize
22KB

MD5
cf4a3715a8b76e5c476fd8a6b0868ee4

SHA1
3cdcaac6547446267c6800251d31b3f7fc132ce5

SHA256
117d37dde72d3c258c67c3eb4f4fdc97c66d2b8736934819132cbb122c22d500

SHA512
95a4433890fd8c6cfc0d56b68c640b1536980e9311c23cb09e8206f61b3b0c126fb84958bb9cc353a4f59356aa134e997aaddb38b54932818f15ff8adab9e3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5798b11df0a7ef5f_0

Filesize
3KB

MD5
d00ce63651d39fab0483b5a7dde55b5c

SHA1
015415327d6baa15bb97c21503621ae7eb0d28ac

SHA256
d6dc7db27321dfa4d6388e3b7b51078f83b8bef1c1fcbec6e99f92b77fa21505

SHA512
88f90a54677a6422a711da52bfe2349914765819415ea660adc1db3c03b8bf016bd4fb66189a4842c91b6cf7c68b82d449d848e1b8ed0bc6f70abd6a2365a46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63ae369f53bd7945_0

Filesize
5KB

MD5
56b81999f2c251cccef524591ab3981c

SHA1
e229661fb4423a91645797f2d493a82f34bf2153

SHA256
64881e7bc556d7ab2d7529378cf4fe898e2390fee20b151d2c1b605cd2bc4b76

SHA512
c81307b5a5aa9e0a6e0e58d61269be95b484bb8afecf6dd7707c3f6eaa3058f49ba195333de31d728f6b7a2f239b6d9bd1656147bf6be32408179e498fb49012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7677a82333308983_0

Filesize
4KB

MD5
be7dac1fc26afda5706f833006cfaefd

SHA1
d436966c93e30d5af25e74903d6864c223ee36ab

SHA256
4e55c07c0907cac364d840f279b88b2ef38e2337da99316f0fd89040adbe3245

SHA512
33835d57e390842c7abce39f4a7e912abf3285ec13b663eee3a93b52b2b4fdb3d9c5a5c35e6f96fdeb4b1a24dcb0bf5ccf9ac29188f99e555ca327de5b96b331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7af9c75b346615af_0

Filesize
291KB

MD5
4703db248cb52dd215678dc8a70c412c

SHA1
ffb89ab28f3fd9eed205052bac6d1b044d2278ee

SHA256
032168284e456998b4fc3cd37a123ed9e23dc87e263f4e72bfa6fadcc341f503

SHA512
f2d98adf32e516000ee0793a1d61bf922644ab83807ed34540aaaf60cc87c00a1e8cdd3df4292851a25ba4c69610476b5b82718dc22b6a093e15a7c48e16e5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8bea4ab3650bee52_0

Filesize
1KB

MD5
5998fda1fafa91e20acfa7eef7bdebaa

SHA1
46b4a429c5070ea8f50cd859eb68782c699bb899

SHA256
dbae03bf79c6fcbc05d6266ec7f5ec5e7aa378e79d57d7ffb32c2b387cbce3b9

SHA512
1feef44698540835fd55150300d66c07431c878013a8e2fe7fb85c1c0e2e8869a1e9083c02bfde8af40aef9fac18974d5fe4bc77f213afeb0f6f266df95fddb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d00ee6fdc5db6f6_0

Filesize
13KB

MD5
6891edd25a536cfdcd6d6756046e6d3f

SHA1
bac85363c25923504c858de8d3f638f57679cb74

SHA256
24e4531a7c1f6c6d6be0ddebdbbbf7bb930fa2eeb4dddfc3af363c3f8ac0cf5c

SHA512
ca86722a0a23caa01de90efc6d667e77f5a212292344533fd937355afe4674e5ae4a0a337437c88d2d9d4ec704a5782eb032186f1a9a58c7034cd09687efeedb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a5e388174f596eb0_0

Filesize
1KB

MD5
9cf32197bdbd26969f9c3938d86b40c3

SHA1
7bb9ba34596761817e27a83675c3f7a3dbf2ed67

SHA256
5f6c0d609bb45f560b3f0efacee01e5444a904a70dd25fe87652ade84b6e4280

SHA512
cd15063ced91dbfbf5e541553ea943a1550f91a84ce0e07d94b78465840f81453d710324b461f871abe1a7d077855ff9a6212535a5f71c6de96817675eb258aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aacf7971e2e1c3e6_0

Filesize
5KB

MD5
e35185fb8704bc3c3aba9327202a3226

SHA1
8f0740b6c6af597a87921b20c89d29114ddac4f3

SHA256
24fcd58957b6b1a5e2b97c71878aafa1a1aca73792e04570c7d83dcc5fcae991

SHA512
4193898e8b9632b5282b2e4f226534bea64bdb5884ecc535cf091d4d8e1e6429f822335db6a873d89759b16821c1ddf6cae0f874f8dee80950dbfa331d5cbeaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce1059c478c2e6f2_0

Filesize
2KB

MD5
e19f2e8051e74821b71eb2924c4f1a44

SHA1
4fcf487f04ffc617c12f74bfaee45b5d06474cf0

SHA256
872da165b2e60e3a4e55fbc15469614f8f6a7f71f06489271fb8a42401b1ad2c

SHA512
6a330e3de9c1a5201b9fab65535aa46939a8b8e884c6d82b448fa072dc4b14054ff257a390da358823fe63c728399d5b738484e77989b21813e515c01738ce43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e18aa04bab8f5865_0

Filesize
10KB

MD5
b49967b58da74ba3acfb5b87c398914a

SHA1
2b381e7c42f1817cc0315648c0d06e65a0a78ca4

SHA256
903b3bfbc317f5b9f04178835ad09b5520f251db51ce88120dbeec3d0c12b076

SHA512
1f15324bff22acab27b762adb7f6be141a062575d137e570fab14dc0e4a57ea8cc173796b3b44cb68d134eeb26e9d98ac923140d8b195e924791971bf5633e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8cea48702440e81_0

Filesize
2KB

MD5
4a4e2bcd7c9227742b41243bdd16d1e0

SHA1
a44d71ded8b3da3ad14b846b7e64627b3000815d

SHA256
d2617c24279ccfd1129047d68fb3c3d187bfb94aa12001319905b0cf89f54e98

SHA512
ea4e58eaa8ce104503c3677d1e4a0e73c3796b0c6127dc37dcabd04021ef742f395ff4f9177bcfa1bdcebe6801e514cdc0a5b55914029df37f68a234c5b3751e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6f866e16e0a926cd1a66091e57e1045f

SHA1
a2c225cd19865373697cf9269352b7db80df1b5f

SHA256
6c5b8eb20bf8b529bf48dc0dc669089cf3a76a7b96d1bf807fa1ef83c617ea3e

SHA512
8055bd5fa41ccbf727772727005f51c0cf869927c4e7d9c41e1e29f9e019865ad52d3b59d74fdff27fc9ae577f1b4598b38922330b32791b775725894580a0d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c903b20edcc3cd39f69062926d6ebf3d

SHA1
76d01a86807d9e89bae79d868b7205a8753ffb4f

SHA256
7f01d9f3abe8010a504d83a9595464794fdc5854ad388e6253fa96cab9cd3e87

SHA512
15f3ea7816d6516dff1dce99c75b6143280ad29b47b1aabc50482a284844077c90607d8772566241de34a820d319422ba45a5cf641f7c65fd27eba98621f0a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
f5efb2cf9219179700770c056a06e17b

SHA1
f821ce0477c2d948f59e90d4e75db6900b1f5f23

SHA256
159439d953aaa2a0e3226ddb534e5d7c96cf304d4b8e92e62e3c91354526ccdf

SHA512
c8a717e42bd30e0fb9b2cdaca6142f7e048fb8133b0168d0f53748bb60cca6ed5ee6b1d26939f7206b033e307bc000e521a5e399aeee1017d8e5ea7856897a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f04f6f2ea410477ea4348deab53e6bb

SHA1
167c88b641571cb09e9d6e84913d8490e5352917

SHA256
1ee8db2232ca6cc20d345f1659fc2d514e2d487596985a0ab9871507a3a83815

SHA512
b4f11ec2bc6e4c4991a04e039195c54cabbd55c516b30e83033fe7044d4a4831d8e0363a6c768399b403258d9061fb6361e11edb91ac599fd27bbcb4cf8bb4b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d62e4c18332e6cb3122392d5df8c3e5

SHA1
8163ad7dc22b8703d291eef94b2141ec83adc2e1

SHA256
1316d013b58d369661cb62a5bc3786ea2dab1893e245f2fb4b4b53ce38feb51f

SHA512
22eaac6c61f99cf4ce75ac500d39397e5ac36d6568c20787149131b281a4577655fca82fd14fcc452ee6d77eab3ebb98ef6742e6a46205119bc4bfb58d019604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
29c835b819c56bf377cc1cf8d619a902

SHA1
b8d74ec5c2ea9d0e763da440c5acccf442e28c06

SHA256
3537aa9af5ad19c50ba548c4b774f7841b67654d1bfd0f2881d145eb46db3ca4

SHA512
91788ac3df1f4944040328033bc35c62b6f259cfed1a34fed91cce9a28eebb6e92c68a560686f26c11dd476fd2820845df19a437142ca752f1e6abcbee55f8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85ebc172d32e6d27ba299bf70c856412

SHA1
4db2c64b54c0c5c52c93cbd7ea000f990dbb34ac

SHA256
2c7f88aec12a64ba2be2b9fb53cc1c8d9c6eb4ae9020c6b6d7ba71cc57e2dd9d

SHA512
c39858c307ba594007f83482f29989714ae54ee392240de1da133d0f6aa8106e42ae49b5ceb227a63bb1a185685f4e89a6226792a31d000e670b6b0b57a160e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a4030a7dd712858bb04cb6f4a08e476

SHA1
12b0d4a3bbdd4b5c04da5be2e7bd74d4ee2583b5

SHA256
f59d3d5121e25a252c7063f9a39c7afefe27b8214580f36c7c40528a537323ec

SHA512
d63c2ab1d77d24dfc2ee16c0dc44c8b81b0bd78d23ad102b980e7f182261aaaa2b23c4e23346242349698c7f3b25a2f2df8479acc27fc9fe63b6e7369928180c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eee4d12122238c38d485955d91824e61

SHA1
1063231b930d18c2c22c80adc21540755e2ea9d4

SHA256
33c2a3598228470db08c6d330ae607b40e880f02d99ef6a6386b51cd6f7a4fa9

SHA512
860bdf9c690e8a2234f00b5da983ca08353d59eb85f166a0dbe534caede7c62cf226f5f9a241175fd4625e3fd6c1129409cbe2cae1cafe74596cfbd8fa711eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a002a421289f9bdfe30473c0f075c426

SHA1
0762b49627812d94a8485d3191590fc3efbc4f51

SHA256
d8604c9ebc5931337088ed7254b78e90a4cbbc7cf1f2ef37862fd392e681e2da

SHA512
461054c9867f9cb4ecdc94c8ef4f5fc29c1e315043972fef78e091805720bd530f45ac717ae001c1250c49c4f0fd566aa4db83e68f6e1201fbf8363a95b313a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
099f86bdcf25278a03d58929de0d5ebd

SHA1
b63ca18eb171297b52b779fc51fc26cff78a99ee

SHA256
e51e6991991de00af49ddb38d91b97754e3d2381d60950128fa1e9890806955f

SHA512
9c4fa72a82d92e655876cac9b0d3ff3ccdb2f677a87086287bfacf5c91888e8ff4834375ae6ab1cce33b1ab95c6d9739fe2a37e31165d2affd4f483a051f2e42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cea99c4c1a4f750694ddbb11c2b60f6c

SHA1
2857ec90f34bc7333f171d919a972753af53c866

SHA256
e24b1898959e50826d7fbd2a8394006ee3a1c0235692250e5a683f458f335bfd

SHA512
fe7e58c57b77b16db291f15463fc5bf9051d87c77f24eea32bd75059471095f8d4fced73f9933ad4e1de21d3e6f41f8dbc6ce6f37ef11d31d9fc5b51f6570c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f5edc419d821032585a121ace0679789

SHA1
490b4478a68c72782189218aa0029558331e70fd

SHA256
b297b9a0332cbca6b5a9b93ed845c5830ef92cbc96feb14985833f88859c6052

SHA512
f88cd8d4b61a57b84739af357a496313a1a475f3b4323d9621beb95c98acc06c39284bd0af346d0de663b170556c4865a6eefc33e324956e2e498a86463ebcbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b59def264d9ad6a718a303f92a222551

SHA1
e1e4163697556f27bec2598eb38e1f23ca637918

SHA256
815bd7046c257f01e1cf1a4f29ff52d38ac4063f387733f0b50c819e5b0431c2

SHA512
186767e08f97a34470cdcef4f67b658fe62e6cd41a8f6a74ee9ad0186a1ac7a53d3b3939169317af175e8e3585efccbed67fc7840b4762def31c3450e6dcc4a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8fd2f319019b9de613a8c285b6126926

SHA1
b4b721ce21e4c605887ee6dbe74b739cc21e7c72

SHA256
187ce8e2e93671e508088d6ebb34fcd3393a62aa2e3fabe79d73ecacadae2f17

SHA512
399447e47ad733a1cba9f0eb9ba9cc4a8be2735f62cb9285e63d62c563818411d228af5e80a3af131200978c706340a477fd6bc8e1256cce07bb4c85ecd9bd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f2e31d425a4ccfd21bfea1f0202a6335

SHA1
6e97174f7a744befeefff6875e0a640d7b029966

SHA256
9d9a4870a152627c54a2f7f43e4baf83e32f2e993f68b69fc8998a5eabdc3049

SHA512
4d1ea79cef75c97eba0ad9993104d033cb6e9e1b0bf370d1b3fe4e20388337382e0e087401808f41e52e491f1800dab3a590ed1bf142e4e78aa5572c01d4a0cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5add32.TMP

Filesize
874B

MD5
34e3f4b57cfeca5ace413002b0a1ce75

SHA1
f76dc77620e3f62c8f84f8f7aa355ca7f75ea017

SHA256
cf694b1856abee49b758494dfc4954d00c5f512f375415d2384ee37ca175e527

SHA512
5ee93c0687f6a2fa43f70699336acad5198d5b78f246f84da71cff077fc5bcb13ca343d05ad6c26d2ed0ecb05b220d75d8610b2429925f06f3722441063dee00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd67e3ae14b88fa88395dabeebe4a162

SHA1
61b359b590c6a234913921c8e281d2e51f91fa7e

SHA256
fcbed563e55e85b56a3a04f7576e6dc8b8aa295cb1629a4a912aa445f104f0fa

SHA512
8df25647b784e2a2cc91e965a40c5dc307823a5a022f8b55a9635adeb95bf1073fdf517fdaa6421def9448e88929d51c4833a0bff90ca9587c285b1f24fed53b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit