hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbGtYeTVuRjZlWEdaOGFDeVpLQzVGRkIzVURMQXxBQ3Jtc0trakpGdG9tOVRtSWFVblo3clkwUDhpcUVMb1pnVk50ckdoQUFKOVlLM0ZLc3I0YjNCTk0ta080V2llWTZBN0lwZkppODIzMVdDcG5tRVBvNjlRSWFqdE9mMk44VmR0N3VWQTh2eGtYUkRHb3QyQmRyUQ&q=https%3A%2F%2Fzaptosis[.]com%2Fpiano-2%2F&v=LIA9RhSv2lc

Analysis

max time kernel
90s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbGtYeTVuRjZlWEdaOGFDeVpLQzVGRkIzVURMQXxBQ3Jtc0trakpGdG9tOVRtSWFVblo3clkwUDhpcUVMb1pnVk50ckdoQUFKOVlLM0ZLc3I0YjNCTk0ta080V2llWTZBN0lwZkppODIzMVdDcG5tRVBvNjlRSWFqdE9mMk44VmR0N3VWQTh2eGtYUkRHb3QyQmRyUQ&q=https%3A%2F%2Fzaptosis.com%2Fpiano-2%2F&v=LIA9RhSv2lc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
4528	msedge.exe
4528	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3584	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3584	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4576	4528	msedge.exe	83
PID 4528 wrote to memory of 4576	4528	msedge.exe	83
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 3620	4528	msedge.exe	84
PID 4528 wrote to memory of 1744	4528	msedge.exe	85
PID 4528 wrote to memory of 1744	4528	msedge.exe	85
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86
PID 4528 wrote to memory of 880	4528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbGtYeTVuRjZlWEdaOGFDeVpLQzVGRkIzVURMQXxBQ3Jtc0trakpGdG9tOVRtSWFVblo3clkwUDhpcUVMb1pnVk50ckdoQUFKOVlLM0ZLc3I0YjNCTk0ta080V2llWTZBN0lwZkppODIzMVdDcG5tRVBvNjlRSWFqdE9mMk44VmR0N3VWQTh2eGtYUkRHb3QyQmRyUQ&q=https%3A%2F%2Fzaptosis.com%2Fpiano-2%2F&v=LIA9RhSv2lc
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc28c346f8,0x7ffc28c34708,0x7ffc28c34718
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8288 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8984 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8980 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8904 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9136 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8676 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5493046350496058675,2428429398706512584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
20KB

MD5
631c4ff7d6e4024e5bdf8eb9fc2a2bcb

SHA1
c59d67b2bb027b438d05bd7c3ad9214393ef51c6

SHA256
27ccc7fad443790d6f9dc6fbb217fc2bc6e12f6a88e010e76d58cc33e1e99c82

SHA512
12517b3522fcc96cfafc031903de605609f91232a965d92473be5c1e7fc9ad4b1a46fa38c554e0613f0b1cfb02fd0a14122eaf77a0bbf3a06bd5868d31d0160e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
221fef201b0caac5556f95b48f680c53

SHA1
b9202f4676f9e4b4ae809a76c0e9354f5f298e26

SHA256
8ffe183fce8871318ee96c40e12efcaf4b8051ee0437965612d706af74df6192

SHA512
4af1f78685d0551268b252761dbb7a40999ba90cb472cd83385dcbd84186a27d9e11321a8392f8b334badd850f7ba23914515dbcb595e55e2f0142f0f7b88140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d17e2594fd88ef22aaa4a72c7412c83

SHA1
bbc3c0b24af55700f6b5777d6c890ceba6e93d63

SHA256
7f4d7fb7339f0951227dfa56e5bee2365d505d81b2380287e5e27447f7b8c358

SHA512
1a57b2573a406a8a20673b4d85be80beb6c408de91e2842f30e6b87bc7889832499deabd9490eba7b9df7f397ae69bc1802347c710d319c5e9dc30f33a0c6e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
3ea2df013effdc833eccc0f6098083de

SHA1
85c8ce43727953770031bdb4a62832faaca40a13

SHA256
7150a05efdb825d461c8ad56c4fce075b1bf8841389d1aea721d9c0c81d2baad

SHA512
a600dbaa2e5bd08a8bacd14b2335acd3fd621ba2dcfb7f80ba326cacedd92b920edea651a482981595d31f3670857c9a5f4ce93da04a8e0f0375225d7acd9bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
871b532c8df13e2149d01d887aee1e00

SHA1
ca65444a828bca4d27ac0ec566b3287fb2a1dd3c

SHA256
c978c8e0b9d405639593fc2a736c903e8fb8f6360b9969162882f0ff4b04ccb7

SHA512
af65b37881b6257392878e12df0ea3af25c2a231f1224fed4321e80c98b70bb86aa00334bc47113bb6294e973180e6b33a5ea3df165e47c7d1204fb5342dbe3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
06b721932a890e8cd64c1b64e5c614d8

SHA1
c3e5fbe7d7dec762b3f56409966946209e0f0a58

SHA256
3b11d2ab92ddd958333a75de3f7345e5b33382d23d6570faf350ae9655d3e59c

SHA512
f292b13ba9a4bb82c94721869661563028495ad87969ae102942cb1cf1c9a2d80ef612e5e3fb913a435edbb38ce436fe35b1e89668846536b12f5562117d3e93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b83ab8fd68ba92da7625fd8e3659f8a

SHA1
42865c6575362a6e22330ea355de8adb1fd1e44b

SHA256
57e59eb1831738d3a32095d474654128c88f508b25c7ab2a89f770566a96e1bb

SHA512
58cc4ef95a02c59bceadc3d42869ed36e0929ab63391ab63a62e866943555618ec922a99e0362cc49acc167fb2705c9a9628b13e8560c32d5f12636c2cd4b1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ebd7ee0b-cbea-4595-95f0-40fe22c051eb\index-dir\temp-index

Filesize
2KB

MD5
f2da95c92f4269da3562a13679cb06db

SHA1
8c8a7ae5f7cd392a18e69ce90791cbf94ebb5051

SHA256
54b1fc4f47b322b7cdd5f4aa1edc44951379e8427315acd75e11f117b901173b

SHA512
688b2930294a6b746ccb481af5c7916c97519a8c86ed0d264dc23a70c753754db2531bc52dd2300af4bda4d7b2af0d66ce3fd90ea13b5c4a9dd708f3ecc5f484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ebd7ee0b-cbea-4595-95f0-40fe22c051eb\index-dir\the-real-index~RFe589f39.TMP

Filesize
48B

MD5
d8a171f0bb436e956dddfa23d001bad6

SHA1
0ad819db7dfd258e90780e2b1e8abf15c8626838

SHA256
41500d51dd78d7f549de205d3e3da3c43a8442420ee4cc2b395483a0c1b60cd9

SHA512
6d68569a6a787a2afd5bd970461565750b24acbe88a33e819dbb183249855aff0851e00cc479f820b583943875a21dc8cc6952fa17330b7d359e195837f54a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
b70d5f81c96aa2095aaf74cb2ef357c5

SHA1
be5a9f1eec5c52b5cf24ee1c5a7f7d303fe44807

SHA256
c30c26e09bba481aa914f2b3d07319079e12f83e19846c20d925fb7b1a020b8b

SHA512
0cb5bc852fa0b3682704df7226f5d3e9df2d5b7eb0b475578505953203528c1c9781b221bb3f1ccdcb0267a3e18e951b86ef17ca2de7453dec04a1adc0b8f7f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
6a199fc71f6978215985fdff764cca33

SHA1
5db7f90ba8828c7d1bf91a52c8b95f7987bc6015

SHA256
0c3887fdbe2b3d8891685b256cbf9892d95d0fd4d4d381173f2078c33697048d

SHA512
2384dafe7930e9cdb61dc1ec4804223e187a798f26d4f78d62e2014e1c3b0f1b6156af9aa79c520eb82fb7360c9e41f666c63f0d616c04322fa0d881a599859a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
86f8f50a9db24016b41818df91e78129

SHA1
0ba37ca020e342b68c2f25b584f495c3100cad54

SHA256
e379c38b18e35e103e406d1b2df9739c2eb5db39cbc54fa71887fa2c659980ef

SHA512
aceb55ae63241d049379dc434b94fb8e68b66df7b9bdbc96fc2fe41b08edf415459233aaa9f03c55481434bafd9f53d08656b6fcabc1e2dca94c6130575217ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe588fa8.TMP

Filesize
89B

MD5
f5893f65f4f005b9a40c71b5b599cb05

SHA1
3f242a2652e0cec1690b5071ed06b3e5fcf2db8d

SHA256
cc673854efc4210a8b2a4498b5e606e64fab153da1c283c120c908e1275f4766

SHA512
4857a65d51d792480865174f350d92e619c664ab6b48ba58d1b19e5b57f7d99cf75af8cb8f06b2c119eb07dba17815fc7b95512d8b39be8ae83386b65ee9a83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
5cacbd4817a5f2a85a0aa9d660be678b

SHA1
6dc577333dd95e2c147cae97ecfefb4a4d91d2a9

SHA256
f0c80b06c4b3e46c715f6e18a02461ff557d544e8e2aabd94d51ecbe47c7eae6

SHA512
830d6bbb627db636af917338c449d26c65d4641e02f5c133b7bd379eb679cafffe787401e21005ac7e78ccfb0b3773ae4910ca01ec64a18052300b9315b34d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eccc.TMP

Filesize
48B

MD5
522b885ec5cfb77dea50191193c1e773

SHA1
10c446e6f678d8c2842436fe9705b46158e21a5e

SHA256
c88982b2f94e5a06dbb44c879cfe4612de7ff761b76951fe881723987ddb070c

SHA512
55d185c5031ba90d9a633033585ec38c42d04b5fa6bcf1d69f41229ec78c72f95ec0413ae4409a5cf238538842cd09adb436fb548aad68c17f6ed77301ca95b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e624e2e4fd8432df69ff28984d4b95a6

SHA1
2763d60b458829c3875b9430e0dc2445f50fb4f9

SHA256
d416fb02ae818b794577d9092d1752c6602220cb38e1c7617b2f94bb8a2f4181

SHA512
829579286f256fb707c99ba65efbc77b376a524a34fc89abed222d3560109f8b4723bed327b7b1d8eb76cdd909b8c0c1bb58a54c4c2eb4d101af8f49266b92c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6b8131e969459852838e68f4000445ab

SHA1
9a19bfe95902a4557d6083f58ec76513d5e2b13a

SHA256
4de9cd096a4f9f9edecac9c9568bf8d2effd7427b544765bbf69a72bb48089f2

SHA512
398bfcaf8dd20477ae2be3b684a3f8d260ecb56361e698fe155688ade13c83f31f2bf93c7ab2cb601c2911568c54e7578a70f25e7de1f9b5da46e6913e42c658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
95ad36b191521d8ed1ebbaee7549b53d

SHA1
c94da68440fe605f1cb451c5cb9364215cf8d9e6

SHA256
ea36882d6a8d4b318fb54b83eb63e793434b6a5ec29786eb0802d2a65d406287

SHA512
c6cd41146334357b270c1d4c804559b31e129966d7cd6311bfcf91b190ceb80baa945f2c30364116dedc797fff738b64cc13bc787d7ca5ec566a358626dd26ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
78a90c2791d360628287458f500d1768

SHA1
29b72f71e57b73932c8fe27b2b7455c51002655e

SHA256
06639faeb528d2df08225a36563488a4605b0321d825f504af1a262c030e84ca

SHA512
01f608ba8c89dc18c3da4991cd4b2260344ddef55d982e580268c35d2196489d0d12c30291311597cd51ad1b8099838a8fe00566dd7891361f1d30c76546a555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
cbb7eb3ed49c734813f9206b44ead525

SHA1
fa5a35f93e8243d793e4849914a0e9943f0bcb49

SHA256
8a95d5896f53b63ec1c30732e642efe35ffde4795ef82be3724804bacd15fd7b

SHA512
88ffd96cb92a78aa3df538d7223e331d06d3e821c785b862a015ace7d763bbc18cffcbd99fb7d9351a1efa5e69bd02bbbdb32bd809ba68c3b46a4f78bfee4b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5802ba.TMP

Filesize
372B

MD5
e43616a1296d8026b4e03a32b06e2946

SHA1
ef19103fdb069b28fa890e758b3d31662cc1417f

SHA256
4269d8bc6882894203dbdae54f9deaec40b01589c08403f67fc8e197bc1364e8

SHA512
585c97ced08a12e729450f2712a9fe14e6907600e1e36d4a9f45e1f8bf8e3c758004737344fd6b6c0dde555590730c36f1ab741a5bf9b85f17ca6aab09de0479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
49993d8230fd332cdb2ebb7f3a100c90

SHA1
c1b9a61d4d915aeb24b3212ebd7a68538b039a34

SHA256
9bfa4441b734b763cc59c4a4bad6d8f6b0da38ef4fcdd0ce9874c2b3e64e59b3

SHA512
9b576dd5626314e43a164c086c86c96ce9c28d54b807ea1f400e18d10dcda44f86cb03e890cca35be589fde2d4362f4b944f93a693de600d2359d03b097ca8df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f677ec5fbeecb4320aa36e764c8a915c

SHA1
a597621efe59b80e497b2aeeabc57b9e6cc21675

SHA256
6374531f46adde39fd0a6d4e94c936b3095860c73b8a6c7efce74a20c4376d6f

SHA512
ce2f6f7d603ccf007eb504abf28af1590d63fd5ea68e9fe819f5a794a78dea353d6314471405edae8c47a25d90495d3732333472ea9d34b22065ee7af4c56cf3

Download Submit