hxxps://drive[.]usercontent[.]google[.]com/download?id=1lI-IL0gg8WoRTc-3cazYsUkFjjstyCRX&export=download&authuser=0

Analysis

max time kernel
269s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.usercontent.google.com/download?id=1lI-IL0gg8WoRTc-3cazYsUkFjjstyCRX&export=download&authuser=0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{A526E3EE-D1AE-434E-B1C2-555748031C3A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1524	msedge.exe
1524	msedge.exe
4040	identity_helper.exe
4040	identity_helper.exe
5880	msedge.exe
5880	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4152	1524	msedge.exe	84
PID 1524 wrote to memory of 4152	1524	msedge.exe	84
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1572	1524	msedge.exe	86
PID 1524 wrote to memory of 1576	1524	msedge.exe	87
PID 1524 wrote to memory of 1576	1524	msedge.exe	87
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88
PID 1524 wrote to memory of 2008	1524	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.usercontent.google.com/download?id=1lI-IL0gg8WoRTc-3cazYsUkFjjstyCRX&export=download&authuser=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed34f46f8,0x7ffed34f4708,0x7ffed34f4718
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1304 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1372 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11771595760816102176,17662211691844461893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8352 /prefetch:1
  2⤵
  PID:5760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d6d02cd-15f8-4db2-9b5c-4c29140c72dd.tmp

Filesize
11KB

MD5
ecb6ae6c460d796010e1261ca51cd619

SHA1
5aa2e45e08b8a2f31c4544ed0a617bc86ef9a0fb

SHA256
b181709ebe6cf487a1d93e5bb01afd441b284b9054de73e452f687e3534c5415

SHA512
933ec7b16d2556d796334223fe14865bd6e06d2d6e867a63134a81a65626f852afcb35906fd051143ddd64d4c0a8162470e9565001ae034935d161429f26f53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
16.9MB

MD5
1e4b2864293d9511d672bb3b5a789fdd

SHA1
d91370d279241b43fe4608981fca12f672f5e7bb

SHA256
372819eb614d2f69227d8e1d71b647e31537d3ec317ba71dbaa9a7240345db7a

SHA512
53aff8f31f9e20e8dae9f1eea1a6d5cc64043061970b362421a6f6d435d86e7d5b797d9c3ca6bf1fea930c797b339fba1567a6b11350b3f499e081a958b9f5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
ed124bdf39bbd5902bd2529a0a4114ea

SHA1
b7dd9d364099ccd4e09fd45f4180d38df6590524

SHA256
48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

SHA512
c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
60f8cd04587a51e31b51d1570d6f889a

SHA1
88574c41d0ab81721b275252464da5c7927a4835

SHA256
27cb4390e32a97375dd4987ae000406933bceba5199f17893711e782333b81cb

SHA512
84c12448ac55dd819749fef9be9919111a3df4bc51e66d2fa9f7376c11c101ed1349cb36aa119aa873cdd6c0c91027e201fbe23c2c83b89bc900a4d9077bcc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.2MB

MD5
2049c79ddc0ba3375dfe1832624bba4c

SHA1
aec0cf9ae1738391d630681d653b08625b276bc3

SHA256
e9cff2115e36f340c8a7cee5f24c5392259cd2c440fc9890b265551e4badf572

SHA512
4fd7488e94e8c9c990439a9200e9317eb7dc50eed35d32d17f13292d4d468949d990afadf4c654e8abadb638aced83cdd868dd6b68d4efe5aeec2670573da0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
63KB

MD5
e4cc1ece2f2425b10ae2ccc212c1dafc

SHA1
92609e6d0093693110baa23758382889bcb30da6

SHA256
92e9415d8bc8529e2a3f335258ef7ff159cce2965ce3b2b7c15f73720efee809

SHA512
2848dee3a6da891b7044518bc97aeafd340705cebe846350b9a7f314b52450f1eb977b8b492638965ce4674ebaa341e4f832438199c3cad2fb0a0793ef83a619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4dfc95705cc12ef8_0

Filesize
27KB

MD5
dca7ea6757ebba8e764d86df1a81576b

SHA1
14d901e264c17c6b780708068b530739622fcf80

SHA256
e8ac272126c14b387867086371510605f57469a06949df265a21cee34b3d5af6

SHA512
c66e6bc1856b88b0cbccc59e12a92ad1a5bbf8f06babea65eb0848343dd9058a1b591493b55bd31a3168cf3442f41f2f0e89e416ccc875ad17b8eabeb9e94bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6c9c064145ebae9cd51f7a896bea40e8

SHA1
778256ad18b92848be59c9e5c9d126af616e457a

SHA256
7379e014f9155f1e8dda9b39c4efb7accd75f175cb088b1f087f2a65aa722269

SHA512
bf4cac105b80d7febbe6bd03b7aa297c7dd8539480dbb1a7b6192ef540d5d5387d134b28dcf7f8d73e29d82a6ca4ba852252c342a1fb3323f176d392670c4af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6109e8731d364177119b6ce883f5edf0

SHA1
9f33cde4dbd0776317038eebd7799c24dea39a3a

SHA256
7c3067f1d9da9d6abd42a518e8035c6b6caf68df6c6d34d364f63985fb9a2460

SHA512
cd907438ea4b8d40d8a24ff3d8f92a34750a0d1e3a1368793aaed55858d7b2bf5d1f8c90dbae7d6c051c3ff72d8446e020e36e24ebbc50241c5b6aaa0ffc2da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c8427e860da73fd3c18047b782551216

SHA1
0d6c12870889f66960f901ad970fbbc6ac6da47b

SHA256
881a7128f86b20c708b591185c13e495a6c30875c9271fbcea238334c0384a89

SHA512
a73947f1c6f041349342b4e7023f1c5244cff0bc372d7df042e8ad2ed7dd14cb85bfb7033ab119cdd5c78652e492ed7bc2b5c6cb3abb0e106e911da47a75f3b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7fb6a2d69d85e0915b119a16d901bbe7

SHA1
59980e554b7dc46ff9c7247664991003f23a173d

SHA256
f6f07193e6b9c4bb5af13ebfc60e3f1aa6d837bfc5cd238fbec2671999a646e6

SHA512
189af431e256f660bba65b04eb90060b8eaa3cea2be94c22db41bed3b612fc2987aee48f9bb96b6ac2f9eee4cc25784437bf88ed6fbf3519dfb358210cbcc4b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b09515f95a81a2a7ebbe302e0d02820f

SHA1
da2f21a72c3e27b70de7110a32170da7f84552dd

SHA256
d7d6673754625c95a6e76a2e41b5d9991001d473f8c1b6265bb4230839b236f4

SHA512
28d233c49262f34e1105cb347df5b7f70c6bfce2fa12b059937b9e7fa8e34255119c5fe3195c4fa0f95665ab8ce4c7821e423d52bef1c90f2df137b9d269867f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
f2137a0a67963793f8c53b17143a68e7

SHA1
a78db097001bcdddfae4b22e9a88e5bf70a82e9f

SHA256
e137d5ff23a1417de220edbbedb9aa469d8c27d354af8be8d72f65e5d36193f8

SHA512
eeb4ac806dea09d4c9b8d83f06fe8e82d544c7d4406805ea8ddc738865d04f8eddda73c2e70c6ddc681e05ed2c063c346db2fb0054aa6e7af58d60e7d8e95363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
2b9d3bdfadcf4b72d8c8dca429df3bce

SHA1
adaa3b07c65b0510a2e0132004139c9cbc67914f

SHA256
d9dc596ae597108d0a20e1b3c92201ac957ead5ec6a30c740cb892ce60a1337f

SHA512
780f8671f1da2e0920cecb4d1adf7afa77d5c3234ef6cda86a6b452e15aa6fa1584f3837b9efcf054c6d64a7304a8962ddc6e33fe608326938030385e4706032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1bbaf1fb70f4abbf3bdc0b84cd0fad6b

SHA1
1b5ffd880251f04652a2790faea233ae38a1276b

SHA256
18b958e039a80fc2743c8b00e5a32a35a199ffc0f30b86ea04de6f8850be76bf

SHA512
dcf86844dbf368a497c281ed56fcc0ba895b55b8cd0c32884b3ee53e16239869658f8e04ed05b7ff0dd3fb2d9d9bf8a9f2be6e39dd1f7fb26e6eb58f5af79be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e2013d180137f8739e705d79ec48ed7

SHA1
d694b54835921ae7208b8d1f3497e53c02bab18d

SHA256
15b91045e483619b8dd933e69f1a0e4668eee879e34a8cd6fc4c28d542710c31

SHA512
ff54916f5f395ddda795902637627c0be2ad37a41c1483f267fc1323e96fe0b112d0db01b14a9a14708fafebf20f645359bfadaa805a0e772e38f3a892164ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
7894ad454c2c87a9d2397036f97a168b

SHA1
047325f827c7911ce211c34518c2cf4c9b0d647e

SHA256
fa5070a6aee317a450a7c3a575a097061d7f3157d9e89a928776284a03073680

SHA512
5748860d8965072683f19d82c3b47139906e37af0cc7829b64c7f9b5666e14bb6cdd6928e0cc5e11c21827f279b906d1f47e75a729d010d725fb383200b79603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7a6b16f4ceda6af520a649b91abd63a3

SHA1
3d03c8290739794d070c9f0d276ced2160b0273d

SHA256
7a2b22905aedb8f20db8e80e70f78a8b5a7f39f6ab57f89e4b2bf4ed0ef9c608

SHA512
961467a7d1d894884d68720fc5396e32e67fe10f289925c228b64ea45ab4379fa965d85f3c2cb72b1770694192682e3c2f6a716194b4d06067203fb4f4bf225a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b5af2e1e7bbd228aa18d84bec0acba9e

SHA1
801846c3fe2a89f3c6d1c79e56279cf353408e61

SHA256
609343b0cd8694a527ce95d79cf6731e82cee1e89d261f87a702eb173db8d3d9

SHA512
ce4b4eaf8467a5f86806e50c73cbd3ed4624b8c0e83f3f67c0483b9ae967caede3a55cf8b522a664200d6f2bc6a132857cf83f8ba8a2dab32e2d3373a2eefd95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c49a5483b3190b16354ca965c7492be2

SHA1
c349fdb3ca780432755e8b9ffbeac00750cdba6b

SHA256
30fca0472e3df3d4294c09820274c44a3c042e0398239d2536a3b30f58124eda

SHA512
f6da54d0caa6bb4801c171ae234f8089868b41836df433c3e0f016c660041115844c482a3fe7b531960c8e1a5e330d14a513cfc5edbb905be642b5245eebb345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
718804d445e3d546439402357ea7f912

SHA1
0439913d7f3bd8c1bde223980b228709cdb462c2

SHA256
f3b50df8d65fe6cd5fa2d79063edbd378770732896ade28967a2b03285dbbe92

SHA512
1268c92a206565eb0c564a6c7ae0513e0bca653b2fe7067681e6bbc57b8b3d8ef422c40985f54679e0c468babe24e341399e1f784507c5a85528773d6a631e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fdca63245b8e5e9536ff0f9d2d6e1295

SHA1
e02b22b140d8f5bb1e28d3d3b0d5d47a7501cc3c

SHA256
6bbb17e3521cf0be42a6ea51c0afd25b504d907b595dc5184bc0ea55a9855b94

SHA512
228ffee49bcdd051591648371ef6e93423d2528f8847f2c1a3cd3c26cb8d04a91a9ba29635045b43dd3825467297d6c404b4649351f76b2c6296ce81bdfb8ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
2c2bf70d8a670120cc49bc76f80aebf4

SHA1
a1e2f7440d0baea8e803cb252319844cdab19e25

SHA256
47be530166ad2c1cbc9c3d0877efef8609c8bdc3de80b6f634d3a0758e977497

SHA512
3c4681afbbb22f83128e0e93bddecb3584fe5b9856c55545bc685978105616d78b40f1aa159b3692169a25935d3495fda4a830937e65f1dfec168560ee29cd25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
6cf591f6334389ff4cc40170700d68dc

SHA1
fb1f937d5ab5e4472ce57b5d9fd81c2cf28664c2

SHA256
6bdf43f4cc0a05847f31f4bf977f8a9f634dae3e7369e080419d7005460ad535

SHA512
f5015e313d499068921828ad851946280cc49b168148a489421ab4ea1f54beee11966835a920fd50b209dec0e4a81f3144dc7ca1ab0b8684d7da992539c7db15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
8a9cd124b8348add1bdd23b4623f8e4b

SHA1
e2319d8977ac63a17f06a0687cb01cecbb577940

SHA256
8fe43e6a362ddfd5b67c57b2ea541324ef7deb5ecc7bd52c470a2e7655182229

SHA512
90936bb8195b8a893141acbb3f0b7223181cf861a3ec9a98a680a13812090781a2248df6c7640c4dc91d4d880904162a2c70092aee78e9c2f7983b871a657227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
be36284089087a94aab4aefd3bc6396a

SHA1
7f1e5bdd552b5bd2d7e12592c5d5a165c6cbfaa4

SHA256
0cfca7a8d6ae8580947a8d1b1090c368e247d2de85f25c40375a47eddf28abea

SHA512
a9287e0a4a46a0cb8b1f4545c27cebd263274c0c54a9b1b6762287e64d4d8d8909bc48691e4a097824f49afb1a618bb24b67a8aff4cca4dc636262171a9aa47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0fc1b6b21d9302670c2fee05a9edd4bd

SHA1
305fb0c4b327d020f2222f97c57f51aa4001d689

SHA256
02c27ef8546154b5c48b4c9066e619175f3271ac6c807746f9c8eca15cc2b4aa

SHA512
ae3baecb8fcc2e66d73aaeebc9ea75b40f24afb98612241d7dcc7398c74c799462d43e0e641a1d22a025edb44f45aadb83713bf3019feb37bfa7ce699af16a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
714f1201121d47348a797d8405bb7fa6

SHA1
c96438d999e3c6ec7edc5cc4442a0caa2e7ce566

SHA256
5dc7c290a73f22556c737f246d830786645362cb37ec7da64b83321cef7e4c33

SHA512
1e4fcb9baee75fe164fe38c20ed3d9eb31eb230fa4f6c91c110d66379339520a0b513aba9e16a21451e382ef2c483937a3f0322d730ff52c87cad9b5ae8119d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
1d05559271665e1b5a5d5ce0826a64ca

SHA1
38b36cb113595cf209cd4994879c06962d71f833

SHA256
f8f02bcba594e6a4c3e101f07921fe8e5b7c48a0db821ae1d9dce7b811d17d54

SHA512
a04bfa33d82ee5e1c0f8e383b2e0ee44108087dea9f137e9c0894cf28d2833dd76b54795c01f2739f1ff83e6330b8bd4de1a616934a8c9b6d02aa5affb0f77b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
344735ebb49cdd6e2c549b651afa0f0d

SHA1
54bb5bffb5826420eb57ed8cb38ac7c42b38ee85

SHA256
df92578d4bc04b10c56f5bc7d18002278657e9780a51bc8b8c05b9652e41dd1e

SHA512
87e09e5d20224bf6c593aa4a51a3a188178ac99d4eb944093337b07cf5cd398d0fbbdb79ad3b8116a849309c4517d8d8a9b771c9d3b8dbbff6406d444002162f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816ee.TMP

Filesize
203B

MD5
57c235fd085e695c1fcfd03b374be596

SHA1
98a4480ce9fe8c7e7739ea8fa874b3d360473814

SHA256
376be6869d78629eef83d3f777b289971efef20137c5e02f7d36440c183149f2

SHA512
0b96229bc02d33c93b59db0fd597d048a746e5437e32e1656313a7de04a202d1f1ecb616e19fa271d374d005521aa28d168b813ed62e04237521fbb0744e151e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
d8703a345d1a47dba6a002428eed9097

SHA1
fb29f05d7725808b2f3c7de1e516aeaa3bd4b16f

SHA256
abd4bd65a63ce56f779e3796f30be43b8cde0bc41c9fbb2f4215c6dfc3b4b83e

SHA512
f4b20fbfeebcde91bea25f64c755dead1196357e9d7958fa15a1a3af5299b4a2cab053ead6de5b46e1beeece9f585467d35d0b64c89aff84a04b295e274e4643

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
4e24a11376ec0c67f51f6d249e07f767

SHA1
fa0f9ac5a12050a722547a35c3c300089befc1ad

SHA256
93e2f2c2e7252119706999fe8191dda54d60d2cc5d945934684a6384f57c11c7

SHA512
58648887ed029f605e9486385dd7b82d643bd73c8279492477a7818e8ad774a68efcf0c5d36c5a40d112153a2d2b2aadec136462ae90bdddb80254d5ee07a506

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
55b033f03b670afbe704c35ec262d6d0

SHA1
d53203bd98127733cc9378f943a76822edb7fbb9

SHA256
8255ae424961428bbe5b98ededaeb987a818592dd8b04308a0b017f5232b9c06

SHA512
179af8332dfbac66cbeee5e50ab480a1bd2b059717908ef31430ec8c870445a251cc54b724e01767e7ecf46472199aa4221355cf6644ba8a9cafdec30907f65f

Download Submit