hxxp://tinyurl[.]com/bloxnice

Resubmissions

02/08/2024, 11:10

240802-m9z17szhlf 3

02/08/2024, 11:07

240802-m8apxswbjr 3

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tinyurl.com/bloxnice

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
2076	msedge.exe
2076	msedge.exe
2452	identity_helper.exe
2452	identity_helper.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3336	2076	msedge.exe	83
PID 2076 wrote to memory of 3336	2076	msedge.exe	83
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 2956	2076	msedge.exe	84
PID 2076 wrote to memory of 3204	2076	msedge.exe	85
PID 2076 wrote to memory of 3204	2076	msedge.exe	85
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86
PID 2076 wrote to memory of 5108	2076	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tinyurl.com/bloxnice
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa41346f8,0x7ffaa4134708,0x7ffaa4134718
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1412 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7405972696658330194,38261113117131381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea9ef805116c4ab90b5800c7cd94ab71

SHA1
eb9c7b8922c8ef79eef1009ab7f530bb57fbbbea

SHA256
bff3e3629de76b8b8dd001c3d8fb986e841c392dfe1982081751b92f5bd567b0

SHA512
8c907d2616ce16cfe08ddeb632f93402e765c5d9430a46e90ab5ea32d4df0a854c6007b19f9b0168254ab7aadf720fed8c68d1a055704db09c1b36c201a9b3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
347755403306a2694773b0c232d3ab2c

SHA1
94d908aa90533fcaef3f1eb5aa93fee183d5f6ac

SHA256
d43f2dd4ac5b6ba779100eb8b84bc92fc8700bedcd339a801c5260b1bb3ce3bf

SHA512
98f1fb18bc34dfc224132dfa2a2e6a131b280b25fcb516fac3bb66da2a47c7a7061124881de6fa5f65602663dc0ea71357b171a3346bb1514176943438322253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
29KB

MD5
e09615de13a0b1ba326172ad17762144

SHA1
6ba17a02d16421e5f0dc9df3c92e9683d13de139

SHA256
e6c8f1b338be9521c32e97d576054f2f571aa0a6d5a2baa9ce0e68222249bc01

SHA512
bc5f59dd2d4d3b850b902f29150aba3ca396c1c684ad00d2b59c4937b43574046f91d3af0b4d4ceaad917a0f6f7874e06b117eddfe158655b97d101f17ece85e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
65KB

MD5
955e81c9a14b03856328c5435c7ca973

SHA1
6bbf244cd7b2b5f8e9f7e44a4defd295a6fd184f

SHA256
2a3ce53a3dc0fc15a0f589f98abaaa9defb277e27676b6d6d1f741317cf374e2

SHA512
3a2e56a64e16bd21ca288778f173eb45f6ab279b96a231b01abc14cfebdbade8b316a88d474d56a3f1be871ab25f8f20f5761ca569a4896b2a114f6be3b7c2ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
149KB

MD5
5a647a245a5dd27775e8b96f194d1536

SHA1
29f7b2e9b0f6f7103cded844e24b9c0276e1bef9

SHA256
8463e57c3b598ce66e87abdabbfa04ebd0c8e30bf2812d03ade7c2f1d25f67fe

SHA512
c6e869b245f3a15e29d45d07f623d754ab2ea36127a80899547ed472be39d7b7d90659d83dd9305036b84779062941d2a5b72202addbc5c1686922577fe01ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
135KB

MD5
34d998b1b76e49cd55098b9596f4a06d

SHA1
89ae79d1c147da897edd43ab8fba030711b24de2

SHA256
b187780e0492be65fd50e601a85f3bea3e5edf0e15a8563b0fcd95c66e3e4cab

SHA512
9c734490da2f67609d09e35d271a212f1ab3b5ff8cd0d0b5dcdf6ff3363943be150bb0034ad61fd0e190e0137aa10b727ed31181abb9582831ecc3ccf17dc93b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
81KB

MD5
869048e32015b6cd10d298c95c642285

SHA1
006b7f8aeaf3221e284188e5a27990a7dba60807

SHA256
9e7ca957cac9312282a92950ff571b8a8302073d0f1b2e7d674a863f683b5532

SHA512
694aca9efc7817732fae3ed9406637799abc3e1cfb8047d2f2b7326646d9cf277f027a6882a58168b5ed4dfa86f0f40360b291aa4649529f9895d80be0cac84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
42KB

MD5
80530ba21263b5e0f581b6392aebcf63

SHA1
dd2c36c5be2306b6a66a372fea390a854e1aa1fa

SHA256
6ef50659893f0b984668c684837c2d1c403565f1febccbc1734937407a71f7de

SHA512
740d12f6c6751ed3e9c00dfd5eced413753c69644acdc7f71ca607b28855bf90b397ae249124c0650c332d0a2f1cc5cb50c790d344ed9669e518fe22af9cb10d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
61KB

MD5
b9af01fb0240f849ba92eec425ddf7d5

SHA1
6214e1209c76f9f46d459eef3c4bc03f5431f2fa

SHA256
dd2d2b3fa1236d246329ba509f520840dd6357dbc50baff741d17647d6a28a3d

SHA512
3c88d7de8ed6814c1e7a92e3cbcab7587b890d98a32d2cef75b1d6034f80e6be0bd71d7ee3a555bcae0dae29c7411824e82f831c36be0bf0576965bc66894304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
59KB

MD5
a3f61bb0b7bf3c9b7399ebeb260b507e

SHA1
0e589a316874773d9a38b675ae31a12905f2022b

SHA256
88e13f5501f3f830373b9e7787dfe70f3bcf0c04fe3e0ace2717146b1f30dd53

SHA512
bcff87e3d0b9d91b1d5c3814046ebe37a5271db44fae98779850f6cee5b64c880b805b66fd8391f47111e65aedb40cd186470b539c61d719ca7c0b4cb5fa1767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
124KB

MD5
703684a98e8a8b125b2bf09927516e01

SHA1
956063ab84ffd188690491b51f733be7e07458d8

SHA256
5ad8335598d08d976c24211981419e22858cb9ca5741e18f3cb73b993a6bc594

SHA512
6710b3cddf9fc7322d28b575bfd07a62697111097149119d5998213189cb361018dd032a4f28925a03b29357f908aa97afbed1513753a9c392fe00b784463179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
27KB

MD5
c0d25ced7cb5dcf4410e6968f7f7848c

SHA1
588e199ef0f9c1ce54702140ea9c978bdbebc43c

SHA256
8073ff708bc0b02ec62325fcc119b7cc6ee9df9a47627167da0d48128781891c

SHA512
6861efb3cc71247e94325c9ae0d0c7293c87292ddf59962701889e83eccf555713779f59800f681d885a8dd04fb4a67b53457457230f423c9e97f36241b24c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
28KB

MD5
6eaba6c08ad3c2b1faba1ea68ba4e637

SHA1
79228c51d1a40bc86c49ad8aebc415891b0226c2

SHA256
71bb0d19ad3f11bb93779b9a23791a9020c9fc39c04c5bd03ef53d8daae50277

SHA512
de89bff019e5e329591719626f4964327ae1c82ce76f330cfaf5040e8c852d422dddb0666e22f91d45adc9955fb61ab6d4fcab86d1c1e7979756c9fa2cd1b382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
25KB

MD5
91f7ad7162e8018b0cf239c70735d664

SHA1
6b49dd2abdeab38b0ad60aec1609a7a368b7be43

SHA256
a1ff7b3cf1549f9152aee9bf7d475ec69f4a5d844c4054fa53a68102c758100f

SHA512
a858860bdf4113877a15f48abb1f831c4a73897ebc64326ad6675010b090716f4a79cce8d419292d39680f0b0664621c4853a07f798d14a2bfc12048f4894fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
23KB

MD5
43881a474ab80ea6f793db5211d28cf1

SHA1
36b1c5e033d7a5ca884eba834aeef209702c7362

SHA256
e50bbfa9012881b4393ab4989a200e78647ee3ae3c0d1ff4bb0f80e6b4bb7bd0

SHA512
87fa402d97283dcf26506f0e02ebbacf225e4f830fc8400707e8a813f6b75b9da724d91ed6a156378c810a162cc1d9694a1a4203b6bee087f3a65fb307e02433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
94KB

MD5
b34cb6ac3a281896bf14a233140527ea

SHA1
a2598b2aec6c2189dc8a3888489c3d72f71a683a

SHA256
eb831acd9c9c82b1a42127c53c42f73c892887fd4c7b4c65173e200ac59c4b77

SHA512
b94e5a4d68b3bfd3f8ad92106acdb5c72d90097965b528acfd6a10c029e5e54412dd9f911d5295e519670c30443f5e23cd2cd081da6a882bd72523dd6781a251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
102KB

MD5
ec183da5501c012be106c8a6a3ba2752

SHA1
98ebba77b84e7cfaf70f0c2111f9ea84866e8389

SHA256
ffebfaa64b5fd2226f8cca688fbcf81e1f5065d0052b81994d820380c8211383

SHA512
5a4e3c5680da597114d9ba7d480488edca7499e0ae217ae587501a849007d9a2ececdfd8542a9218c14fa2bcf1abe76cc8366d14a61d9c3628f730948b6107ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
19KB

MD5
ec3db1c15175fde7ace796dbbb63e716

SHA1
f432cdbf4a49e3834f09a3a4002278d1de0e7a35

SHA256
1ffef9ddf8cb5322f1bf11bb3906092b970dc10ea50f436bfae0163dd69d440f

SHA512
a033745583274024b56115f45190561f61eebf7cdc092183f40bfa0efe52307ba8a7e491bfa24f000cdae5da690649de648f0b11a1c0482260a8785f4faa9637

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
19KB

MD5
bbd915706acdc5220bd556168264f93d

SHA1
44d51901e733af43e5df639de54d422bf50c16c3

SHA256
2763de4dbbc921afb96c3e78f7686d7d46e778102264c166702854250828e5ea

SHA512
02daed15420b9b81e34bb207d0bfd1270386e7eea619d00459d29c1e9b484b02d9978e0fc07c87dd94dbdf43f19eea6f863b06b7959fa06198f03f0ca2182acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
32KB

MD5
31b3c523097f78166efc39859e29e897

SHA1
433a0f0e4015b3e3782fdd48a58c5ac72402b8a1

SHA256
2327864f0779a638fdf619c42f1ad178ad03ed3bacc3a578a1c3d9b82a62d4f8

SHA512
8ae3880da9e6abddfbb2f51734dea7bc873c7dd2bd4ef36656b74c4754cf9a76348cfe255df3068b7f9f7cf94281f2e7cfd952a986a17e3618244e3e95fac125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f1f308a455adf1a7c524b98a39b860be

SHA1
407943e67439f34c68f3d2ace5401a12a3e6d1dd

SHA256
103d5fb5c40f9c799fa2716e6cfa26df982750d6f86e95222d2ad6093cc637ee

SHA512
e9bebaa1636db4267b50faeb7e0b6603f4e0f89a7a1b7d779b6f86e047b553347d2506879db8c3551be0315771605e5b51bde554013c306eeb8999b3596de795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c673a6c50e987b09a2aee7e619625ae9

SHA1
21b569711a0207d73745bf3e59161b3c11750269

SHA256
b551c9644e52ed733660f9004d691ae1b5d35edf79386aafa9250c91bcc7838d

SHA512
cfaeab0acfe0d86e2bd2f3c86c5e02cf9eeded6f6fda18e8d95af8414ad9894c8088d7255312efeb8ea517011d5b23b3a20e5b9b016cc4c2a32d4352e1110353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
8f942110f29e1a15fb075739f5cc6d5b

SHA1
a4f80a34a911bf8146fb6492a6420b65313ed902

SHA256
16dcd90a0f33bbc2f4d265555c78c37a6540822ee7bcf008f8816107fa1f9881

SHA512
8b40316dc778b989e87bfa5b49a73d9b6eed0c05c07f0fec26896e40f9ee44143172705b468b4f44235ecb67c0608a92290eb0f0cc85325afc0a1ec9c8071def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8dd996efa4e12c7de103347ccdbca199

SHA1
5c2e0fe0dccce7a7ac7b8f0b17ccdcff62782c5a

SHA256
b54bf223466f8850cca37fd190ec713df06f45a32cbef1cb26d22b6521f50013

SHA512
d067ad0456ec222d8e81c8203b9f89c26b5bebc429c592eb775f43b55f6030ef741f406f61b6353d379e550acd7f4559183a1c44c0276ccb8cc7e473c7e229ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
eedb20e5cdaa68ffa2c6edaf218d4c23

SHA1
2199322ada2467cca7e6ce06a71725401b25bf57

SHA256
b7b8d8e0faa4363bd5a2aae038d92ba9adf7275522c8dd2c649948a658755f66

SHA512
f0f494dd2a28a34f707d0f3d42f219b3906716990e81b3895044051dcf23506ee3979227bf8ecd05fd4d51ca973519d5a47df1115058f714ec9fa6d35fb3a0e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8697103985073b3716334b421172401

SHA1
f635b0a173221b1ba2e6837eadbf6a8b32698a8d

SHA256
992f0ab37563eee0094df84697ee358798049abc807eb8a5ffeaace8f78095eb

SHA512
90af1c512a941f99504a42cda4495c168ffc695e2ebe269ef914900886494d79c84ff0716947c2d4b600cb2f71bbcb8018be40accd7b610ff1681d588a3fe6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
50df4323a98e5f5ece6f637327bf5302

SHA1
4fc37cadc4d0433d47b1bce46f25eb7e6391e232

SHA256
d04908b676233942b9ee258bc50aad6038dca796184c724272b51c9c5537f22e

SHA512
ef777f8a3aa1a915b8b518046359b164f848759d57a830a4cb813d1c3d4f94d09b2b65eced1ce9144a311a27a76e0add5d44e956de749819f494a6512e206766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ddb18ef8e9ec1f64f138bd4823fec0d2

SHA1
e1f5e30a938ace3aca1364f811a8540ca6f93f2f

SHA256
06d4ba99381d60f10e029d3673671a51947ea370a639bd989b9056cbd70e248d

SHA512
34cd2ac0847c781a35a80a42a522adfa7b77fec66349dc7385479caca602276934e96a9a101d669d55380898620767ef75ded899013ff16059b5155ca98288ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ce71f92481bb48423e2b4c26d0708901

SHA1
c86706aeb7ef390b60f4e20ad8cbb96f4eeb3e84

SHA256
9e8a3e514f0560fb77e85ee32674cfc5efe9ffef31e4f89d1cd61c3bc1b02b2e

SHA512
782edbb224e916da5b4af5b6b19bcf26e6636d1445ab6f952f449cac100d73c174bd8071896a5a4e432d41d6597b607871d801007e20109dc72c2674cdff831f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6243066eac39cce6124480bb83ac1171

SHA1
1aa9c440b1f2cbdf4b0bd9b51d1b11e9ed3f5112

SHA256
cb241566f32728151add607773e2bc287eea62fa09198ec9b48edeb95fbe105d

SHA512
d82ba9b3b4e3ccdfb7b32c0da86e768da972338b077da0a537bed8bad137345121d838b55da9701cdbe7bcf823a347188482e392a132c29eee6e52220a4e6041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8537c99c80d16bd91cdd00dbfb92125

SHA1
6525854b6ca8db2a08930aa43990e05e54cf72ab

SHA256
4a6724cbf2f26dc3e556ef0d8fd87275e2a5b83db2cd016b89b01022a3e2c07d

SHA512
d8f582b2f9bc997fa3cc6cf91e186f59d576b5462a0eafb650fa93574d623e1705d2c89e1d08d7886feb9af91b99a170a372aa89e9f16e4717a7982ec6b785b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
051876b99358a460317db04b7a695122

SHA1
0e2670b99db8f22f70b5f51f57ec16d3c1554b52

SHA256
fb034fe4e65966377696676f06f37a783d09e829cc04e5eb0350b698878cb53a

SHA512
25f1c9323f6116a213cf6a3311fdd3e5347f9ed727e62d4c54847974a9c07fb0faae0f73787d332724077803ac587828eadd06d216b0bbcd88a21bec4b13de55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
e89373f731d96cf91b5f812bbf764788

SHA1
da9b643de59f276beaa68a0b0087f66f3a5e0b41

SHA256
dee854a4cdf0332589f2c28a7de53c26b4901d15c599cc7f57ad2bbf8f84021d

SHA512
37ea948f56c5b670c846de2756cdf0e4fca9b44abb185a63f84fced4a29aa77f40e6af3e57cd10880c7ae79ce8e1e445f301ec5a6242f89b2137440e2ea0c06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3195c5db16b727c37913ac9dd2d2dc82

SHA1
613cb8ec69b951f28f7d468ad6427295ca67e514

SHA256
c45198ec9d6e5e9bb573cc1d60eb8a1e2f0275f9d3d63ef74c75edec4d66be5d

SHA512
db6382103c9af510c0f3ffa277430af6b93f495839cdabd64990a7a9e00fe6a4d2f208b707432a2111d4b38f74d4b4ff44f55faff0d38286c95189368ad34c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582f29.TMP

Filesize
539B

MD5
9cd75c73ac2806f82628f71884104a35

SHA1
1b65743405fb43461d701064332d13aa32103330

SHA256
4acdf05b48d010146ee854b7ab29cef67e236bbb16784601a2ab296e0f5ec7ea

SHA512
8b6bec4a5e739f830000ac6da12480c98ea8c4995ac07e6c8e3c5fc048cfe3c67e3cdaf8624620f627aaf2228269c5d6b0241bf42905d17458e485dedd0e86d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6dabba141a8e3bbe7e0e8d3dcb948684

SHA1
495902351370a8fb20bd9e07d911cebaebd0b824

SHA256
722f2f391e377e50abc8f8150e31d9cf73afaca8a51ef411efba3b0df97cc616

SHA512
1f0b98eee5a8d7adcee8adb55e4461cae837f06e9db8de66874f5dab6a50dcf93f0ad24fa3343435623601f1acdd5cad58c68527189a6f9affe11e8a22fe1db0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
a7f881a4f19ccc7d7cca88b68c608416

SHA1
82e3548601e7b87e46ee93ad12690949a36b1d9f

SHA256
4a8a3e93eaaf3585a3e4835c42f8a9fc01c9020493b5bd193591d194c544d238

SHA512
7559fddf83a1b20d4eceda1a4081976952930e9dfdf3c5fc044814c7fe6a5f07b4891bba8c7f79f4dae3097d4d3c4b042c21a30470e156789d4d535e78b10fb5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
2687004e7df8240e9b996aef3685e801

SHA1
b1e646fc69c22463ae063279046d1fef77616b13

SHA256
339ef6d4f0cf80460ce75c4298e5ccde3ab2257b7a0d36d6b39ca962ae340434

SHA512
6c27784d79aa3be65fcc4f410de95224eaa9c684dc83718b368629f1ad21f307dac9e8f68e34fa1b832e88a68354d346e949e9c8b0834d972b127c1a91f26889

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
4f7127a39d39a91e8c06250c109fd475

SHA1
96d9e3b0a1209123d9b6a5945e13d86ef1d1d16d

SHA256
aaec80d3f3e7e5758bfd8f2b9937b83bb330778d1477286346436c74faa897c8

SHA512
7552eb3393be0a6b1a897c2e3655e99b270f075bb1a4089774ec31c28ac143afddf6e57271c482252ceed3d6f3d471975a966ba7f27e07ea59470be43b1791bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
c7a3ffea48b5c0c3fa7d0974427ee70d

SHA1
dee96e9bd6e9e8883252d8190524f23f41b830cf

SHA256
78b3964de49bed5268f35f8ebf412b5c584038566ab87a6970f4dfd26e1b9ceb

SHA512
1d569e3bee9b01755f44bdee67a7ad9932677300af98d4f61c2f0041e47c0a5ad3871952efa143b3d275dfee0d09e18ac08663c3a5a3c7ca6ddf75e07e6d7eb0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
cdd342bcc1b81a5610e730c7dd400dbb

SHA1
681ad59bc015977dedf1c4f8160f189a8c0d9f82

SHA256
f19b109863194f19fb872b2b2508d1b0c2ed95d46c1c006818e4300ca12fb0e4

SHA512
08702538e017ebfa3a3911c095c6260b4148a7d74c185e49a7ca3a29c949cfd1c3888a9c127f26331d6b323625b902c28b5f9df484791170e18a8b309f4d2e33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
e78f4cc78e9fd07ac214e4e6b5596de7

SHA1
24d0ced81e7ec50968da67ebb1999049ee85a6d2

SHA256
10daf0070f175e3a97c65ea6e8088539f0ce81bfb02f379b91eb906b5814aa5f

SHA512
be1d4523cef215be87fbbcbf7c72346a2745d35ec2e9c44cab881ac826875632050325c4efc2621e7699e82c899a773d29a521acdfa69a4f026aa67b474b7390

Download Submit