hxxps://en[.]taiwebs[.]com/windows/download-voicemod-pro-3600[.]html

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://en.taiwebs.com/windows/download-voicemod-pro-3600.html

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
2332	msedge.exe
2332	msedge.exe
756	identity_helper.exe
756	identity_helper.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2228	2332	msedge.exe	85
PID 2332 wrote to memory of 2228	2332	msedge.exe	85
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 1044	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	87
PID 2332 wrote to memory of 4868	2332	msedge.exe	87
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88
PID 2332 wrote to memory of 4380	2332	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://en.taiwebs.com/windows/download-voicemod-pro-3600.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a8d346f8,0x7ff8a8d34708,0x7ff8a8d34718
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7848 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8864 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8880 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7564 /prefetch:8
  2⤵
  PID:6432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9308 /prefetch:1
  2⤵
  PID:6752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11830881397490011156,12903957874857259821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5348

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x2f8
1⤵
PID:6492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
143KB

MD5
1c9e79d410b946735ff27dd9399d0616

SHA1
841c62eded2bbc62fad1c6038308a1feea476a14

SHA256
b204401f91bdd702f8c5df1fba672fad39ae1c36a79aca69fcf3a75c5453f760

SHA512
970d45488c74a54e7eb506c05261c57071f3608fcc1fbba62d26a59b922f26d4d117406483079b711109308b94e992c01c14af84e013e2c08caba068017a22d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
25KB

MD5
03b508e96f16f8ff5c8e5e7447dc7e7c

SHA1
c599009c8df338eec24f540deccdc5bfb705b05a

SHA256
fe5d9219830770f0954871cec1332c0072ae5b998c35f58c0ebea87d334be7f7

SHA512
7bcaca33eda97bcf0da17c8f23289aa5e6170d35780f6992daae8a63ab4a297e92ff3ef4562bd14af4a98b5ae23935a0942b387951a47082c0650332bd73eac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
251KB

MD5
44c9e895588f26866f4be671bdce0661

SHA1
bb305e9cb8310b523cce330041b3b93501487ed1

SHA256
8d8233a5ae11590f954f643407060a4a776b3dbcaad06aac15489c7222a1dc53

SHA512
b67eba6e03965fc1606c71281a369c49b1c8ae8d6c16bb735301b1de9a49ea423acb973193dafca49211579334b6a784ba66204b29d74f825da287d9b704cf0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
263KB

MD5
3e4a0ce60ef774a371322c5c67243ae1

SHA1
072cafc1b7d5bdf3f27751d3abb6e868271476bb

SHA256
2b5ab4aa62e03347e8b37460ccf322a4d08f697d04a191a7812d9c7ad59c53b0

SHA512
45cd6396c661fa380327236f07fe3ffe62d692ff5d1eb33c450375f1693c7467b01c983ae41763dc7558d0f142726df08d1b2d1a19bb960dd89864b2233d77ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
16KB

MD5
49295de6ccd23cf80b6418a2d209868f

SHA1
42a955b4560bb22cb9b5b39577f7a691ea345018

SHA256
d5a29c73c6200af2ed6918a61106e649b92098ecd476830d725ed4d2ea5a8efa

SHA512
2954ab185fd84a08933bb6e79d91e301021fce4e632b477e765c172cacf72913561e101ed2f7e66bfbdc5946b35f2b63eb2b6f878e0afc9d26ffe71ee112a1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
64KB

MD5
c86e1b32988ffbc37474c5ea5457a62e

SHA1
3b337c4d43ff0b4ff79f9bbcecff8143839c6cfe

SHA256
d94398ba2ed0b438809ec4203c64c002b4a0d960fbd34ab144b78fe7a49323fd

SHA512
58ac67c26bca36a29799d49ed95980a15b1e279282e425ce13620cbe93a8cff74e1c520b896f8e9545a6b7eb8266394547949d88ad96bcf2a879da65521e7f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4675e461e9d429a4_0

Filesize
243B

MD5
33dad7c105e56226009ba66ab110dfe1

SHA1
8263cb4b3109f854b2f1955fcbaed3c75fe10bdb

SHA256
0acf6ae86ce4dede6b427c109f34f0faf51eceb6ba66079580592a1bb6ac48d8

SHA512
66b38aeda0c540ea838589feaf65d9b52dc7715593fb1642c742786bf9118fa508f1db159de4436fe9b3aab7dfea1a88a06235a7829e4baa0ad3261d002cfb42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\963aa82aad10c594_0

Filesize
73KB

MD5
4a8e197e49c5275be01f37fecce47054

SHA1
1e91bac2e043a6c22c6517d648105bb6ad32d12f

SHA256
6863fab300e196fddfd781980d1596ebf0c211488f35df527fde6075e49f1e35

SHA512
2bc71430b2e41d79f4af2ee30ee1a2adb648e8743746b7a650f79c7ba86c484101cd67fd6c1d5b491c1689c8262b4a976ab6cfe2f262bf8ae6c9e6303cffc810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a3ebfc89c8bb523_0

Filesize
31KB

MD5
8abc32b2975299ce59e2de18de757c10

SHA1
773bbc2a14aaf8bcd3aa339e081aa3c7b7ca8129

SHA256
a15a981dce16210968ea0d18439cd39e63c982b618873ff885c1d97f2bb52e9e

SHA512
3f54332a4e414fcc47c66b916d5dbac14db6ea94bb206fcb2976b9c5db5043b4ac37f7ee74472d0b2b4a83d4659ebf0d31bad3e2e07436e28d30026490abbed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af48013e22f4fb3e_0

Filesize
256B

MD5
623c6584413d2638859e3f84306d66de

SHA1
ca02e6a6529d0864cfbf44483fd3d730440e2e2b

SHA256
be4f016e9456b4b4ada9c212add2e9ab7afeff633ca3337286cf8974d9a28288

SHA512
ac29a89883467792dd6de7c0d2e0f0d3f48c2b024b86f8d02563654dee5a01ba9cdb7c69e0308e10256264e48ba6327e1dbda5c8c9211330cc5e69d868145ab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f28146917bb837d9_0

Filesize
42KB

MD5
242a9b85d88e2f13d17a0092cc15cd95

SHA1
6491883ef6387c0bb165d6ad9b52a4d82b57c5c8

SHA256
9f0bb94e165387ae4ad0fcd6c8d18c600120de93c0d99980b63be2f467716067

SHA512
176d52a2a53293b022fc1bdb67052bf908f871b395b0f0a0b7f1c5d4f863e13736fd27e778d4a80ed59fad595aeeb0285426608706ea9a7f6632b8e6a00247e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f56766d4914f0c76_0

Filesize
591KB

MD5
9b89c82f940f4d1f836b6ecfba3ca33e

SHA1
d45785680cf7193a2530fe3b1d518e59791d2880

SHA256
0389f1a402f19d43f75fd3ecbea9ab3ec76361c0b3cdc3cf09570171aa8495c4

SHA512
a1716c0ad8d91b67e6295159720607d721addabc25fc387225a624a0c295dc20c67d096e031d6803c4a3cab41a300bc19f254b390085e8ebd35d27c9e6f2e831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a62248f1b2f4eb0f481cdb2a67f40ba1

SHA1
32f2633913bc755c09298fd147628d748e35324b

SHA256
7519db86ffe1d1642f5fb387f399e2a03cc2d6c9326dde10cc6501691c2a2359

SHA512
b52262e1405ddc2bbc017a4d5ba30da788dc3137cd867b0c7344fb64253a0533afe95fc2045479d6325519b84a0a4965d65ebe186e23f5b1a5234b1d99f1a958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
32d2759de73165665467c6580ca8715e

SHA1
7f2e5c20edfd58c6760dbd6cffbd225cd4f36bbc

SHA256
8bae3544be0b3dc45bb1a27d592244e3a9d50aebb4677c6a655f9ebb6c00ab21

SHA512
fd5f74f08eee17598a7013393f1e79bf295024fecc43d1f4c9695aec4c45198791e8cc7a5a78004a521a3c6f0d4a87d25dc2ebb33b2db76f46c7f87ea5389cd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
d2ee0ea60da7b72488c42d23a21a2fc1

SHA1
b9f6efdefd2e92998d8b0290f67fdb477dc0dc5d

SHA256
d51ad3f9e008971980a92b0322073515b0658b299dec4e88021b4266029dda2b

SHA512
d0acbefecb1de2fb1f5c9cc722561abfe633d3f48d595f35300455bc2b2aec0add963ffa5b963195883fa224a40a2c4d4a14581bbe3f57eb51c7bb2145297b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
3ea30af0c7b0871cbc2b1abda5af1bc6

SHA1
a0db6f98c6e0a679e22f4b92b6a76eb78f58022c

SHA256
94b7eb948b37f275929b28e0bae078bb6df5542bf7d289134ecf808d0b32d505

SHA512
d8b51429a3a2eba7c0121464fc222e34d4c37ac0caab5f8b69206d2bf2891b9a68b5e56bae9a8402d3c47b4845bb48f47b61d2914616a336e510597a1ff2ec37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7df634ba09ca2c1e107f3d4ee0d70fdf

SHA1
e0d6e12951f7f88164fe52e0741bb16f9bd2e14b

SHA256
66928b9d0bcaf9dde3afb00e01480054e930d3c513151bb32ad952efeb8d953d

SHA512
72b9cadc7898919c47a1dc82d431dc938c34f8d8ebfa433ac93273c42c5cf350b476030c5abd20e22e71715a16388384d1b1d95aec72f993dd0f6625097d89c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
dc869288820fc152f3edff0f855c3e5f

SHA1
63740d935532978bf9e6f57dc0137c10e516eada

SHA256
498d49f69accb740ca857538c7a26f1d64036afd7e823d96eead32f5d4b95d88

SHA512
08af72a43b2bff6adb28930afaa717baeda85ec2be6b1c3a5c4c2e155b3a3e6700e1e8e40625340f3e53a5cd15041996bf99008644e6d29b99543b6652b2be35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
04d3b8d1f6d82e773fb82155c85d10ad

SHA1
c2ece59a15673fcb44ef8121b0810e97bdde3170

SHA256
ed7f285950118a039c30447ea2a58fa6a31f2d8eb944628db465e2bf2065f0d5

SHA512
ff8e5270cf3a3224107b4c157279a5b8b04bff3638b491ca5f63c3e7359db66275214d5e52e81d0d7ff2c5a6921e94527a4a7cfab235209b67bce318b728acfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d4c727608a77b518d23d8b20351a20fb

SHA1
9c62d27d775773f7eb1590078423d648cd9dca4c

SHA256
1c36c513ee47b182b7849c2862a0375be9bcc85f1e1546c9e2fa5a193997937f

SHA512
2dbcbe4c0e2d2ae45483d84203699b042c6db8e09f30bd8c840405bbd830ba1b7dcdda80e9d8a4ce09476dd224c4474afc541962b322f4fe1773a653a4b31bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
0312bc70136946d74c944bf7efbac9c2

SHA1
3cae62ec53ec06ea4d449ac10158a187081baece

SHA256
6eed6c586cf433a208dc8aba0497313f9e9c8d1b5ef7d42f0d76c4915441d59c

SHA512
d10151bb4b294abde8067b6cbe326609d1e5395626b710e5483d697e6df88b2ac25e611b96a654ae5ebca9c0a864d2780b8e751e376ef8ef50c6b9ba0ef7958d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
75d7414ced99701b90d81298e9f8c095

SHA1
ac86ef76818d2e55089bc67e8443b559b6f77283

SHA256
fa561d9c22859d317ce2bd0dc05a6851a9824933db241af482fa352bd86ec8bd

SHA512
7b6ae5e3fa57a1aaf40a73fb7ad73bcccbf1a481210271764115374d0fa0fa1da70d8d42af8ae3c68bf871cf6a464c36b8b103bdb8672aa645749ba1433874ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4c702e502e47d1340c69869dd920266c

SHA1
346f1559d3b42e7b4940cd394a5748d70dd9dcd9

SHA256
11307978df2063465e1a964336426d01c9874c2061639d040958edbc29f6a06a

SHA512
c51f21e5696ba90ac69a8cb7af050b756711eb91f79be9cd84ebd1d4032a3008b75383aae70a6f6110bbc70ef40498c3596eeca9a153c9b68a23d39e03628d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
70228fbc5da804f86ac3eb1b5f146e74

SHA1
045fd81f0e4b14062dd822834f420f38239892a2

SHA256
e662170c7daaed33d3c42671e3f90f689e09d0c8c08ed9f2ed8cddfa9cbc01f1

SHA512
ed36f035e5ee39afed7a8911e7943d4248a9b1c959e16b4ac29443bd5176a9251a295661e1e3d1d03711770c1979125bcf466d278ce332c689f6ac08907fda1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
bd52eab9a8063f8c1c4191b81c2624ff

SHA1
9100170fe2862bcb14e8359e43025114da0056bc

SHA256
439c298da741ac6e6a98104ebc9ea5af631a6e0409b513a34cb5fc35721ba2c4

SHA512
1c810157ba4fde4cec9b49fe35a162159557602be5b520857f927204a05d1d7281e087eb334c42f41b9d10d347181985a405c4aafdec6eb47b9e4a2b993bbd7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c70b2edb9a5542984e370ff2a9d5a975

SHA1
793b7fc1c3b84bb8c708669b24835103351781a0

SHA256
d464be0bf1d6ea15bd4298046f46613dd392c1c19736450f272f5a7a11e895df

SHA512
2f04a0e2055b46d11db4e5c2a625ae95b5618e01750d8ba7a408d9aeac51b3c25e9e7ba5b4b03cd4fc8c7dd3465f35699daec9ca6911f11d24fd3228cc7f9968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f7c52d4840b717cb1e37342c37df8399

SHA1
48718fac2cd7c5ff475ef4d6ea1028ebf738ae09

SHA256
cb98e2944f22e80a864f25b8a14316b8d99d56b72d3a09d6c50d0c39c1cae610

SHA512
85d3632b003747ac8c4627361afa7b77a66159aece9ec50953ce8d660c7b7e8cc45e017676737deadceb674f288935f06c8ef0241ce543afad795fe8765480b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RF43c4a.TMP

Filesize
3KB

MD5
1e2ab66e78799a6b53890c9cf60585ab

SHA1
687323589bf8e7212c8ebe0c21e25ac7712e7230

SHA256
f60db2971ae6112502f3ca62727b26db4936be739927488bbaf9cb505f2f9ecf

SHA512
fdd9b91ac91f64ccee1bfbeae8275834b3d5a897030ddd5cdfa90a6f7d5ab0c0bab0dd8f637de11fb70cea5fe8f6414e1081714979796978fb5e2018df7c81fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7b20bcd57a56899940ebba89e2d3291a

SHA1
92012507bc74937ad52a5b0050f4049221e82f47

SHA256
f1677c998ef394642431f7444bb6da13d6e44df1ff40d4c35b6272ed9b96dfb1

SHA512
d434b356980e710b8413371d2d47e063de81c917da73edb717b5d53badfe7335cc5ca97ac85d5987e4e142dcd88742d79ec1dd8251f4c5f9ef7564ca29e79cc8

Download Submit