hxxp://Google[.]com

Analysis

max time kernel
235s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
24/09/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Google.com
Sample240924-vcsjvstfll

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
121	discord.com
122	discord.com
123	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629364133-3182087385-364449604-1000\{3741F5C8-3F19-46E8-8BF0-950B1CBB51ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
3388	msedge.exe
3388	msedge.exe
1296	identity_helper.exe
1296	identity_helper.exe
2272	msedge.exe
2272	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3148	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3148	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4020	3388	msedge.exe	84
PID 3388 wrote to memory of 4020	3388	msedge.exe	84
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 1216	3388	msedge.exe	85
PID 3388 wrote to memory of 4188	3388	msedge.exe	86
PID 3388 wrote to memory of 4188	3388	msedge.exe	86
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87
PID 3388 wrote to memory of 1016	3388	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5e2d46f8,0x7ffe5e2d4708,0x7ffe5e2d4718
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10291563060113156788,13039704525864469214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x374
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5e5afb63-66e4-44cc-8359-9966464034f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e5afb63-66e4-44cc-8359-9966464034f1.tmp
Size 10KB
SHA256 28a008a0961d9cbe1f5ef7bdcb7d1c8fddc6d74f822d42a54f903bf4af148565
MD5 ac5df3188635aaff1bf16903cd277796
SHA1 dc73c9b548d19434877353b38819ebf526ac370f
SHA512 007032f88111fabad3c88c908bb61d041535da669fd184345f5ec7f1d6421e7965fe21a90112517dbdad38d3df908833bc7b8c00fc00d260229ecb51ae9d3ead
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFMe2RUi6vhuidy0x6hu:A9iIxuERzA83h09RZxYFSgw0Yhu
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814
MD5 7006aacd11b992cd29fca21e619e86ea
SHA1 f224b726a114d4c73d7379236739d5fbb8e7f7b7
SHA512 6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
MD5 b80cf20d9e8cf6a579981bfaab1bdce2
SHA1 171a886be3a882bd04206295ce7f1db5b8b7035e
SHA512 0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
MD5 SHA1 SHA512

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055
Size 38KB
SHA256 13da02ce62b1a388a7c8d6f3bd286fe774ee2b91ac63d281523e80b2a8a063bc
MD5 ff5eccde83f118cea0224ebbb9dc3179
SHA1 0ad305614c46bdb6b7bb3445c2430e12aecee879
SHA512 03dc88f429dd72d9433605c7c0f5659ad8d72f222da0bb6bf03b46f4a509b17ec2181af5db180c2f6d11c02f39a871c651be82e28fb5859037e1bbf6a7a20f6b
SSDEEP 768:w35mZVsqT7RAo+6tbgLdolT9YSswcTWa+O/dm8ae41u37qt+:1xTO3kb0dolT998WhO/Hae4jt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f
Size 99KB
SHA256 8dd2d96eb579fa0a19769397b6f8416d03ebcc4ebce0807a4e912ed791e2f673
MD5 eed8161092e8fdedc964621b12dde3d5
SHA1 31de8c8c61ea298d6530977fcc8acb5898cc38ed
SHA512 e3dac103df46d3dcdc1ad1e8e3fc7f63ac4803f25e84edd975dd66d0c4d0889bf680430c8e6d3a79119c6505e4f186f0c42444d4dc7b9722d5b959240ae9c701
SSDEEP 1536:l3qNuIS5zL1oyh71kwQB52lIv9s/PVFSEhJrhGxJ6gvYVAUEGm0uCjdOfkZKLD:l3qNWPoyhlQ1v9sHVZnrhGxJ4EF0Cf5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060
Size 425KB
SHA256 7797e6ff95678a5e1f404e56dbc596bd18dae2b174f5c2e9bb959ee10d06ad8a
MD5 211f5fee14ab83171cbc02bdac7fc54d
SHA1 363fb08c96d6f7b3ff2f513718526734b2a6d004
SHA512 029d8b2bfaea1cd7515791a79fffe3753f5c7128978323ae03e60b5149f5262f114986a51696017a1cf1a71af5ad22921ceb1edd93d522e58ee873857439eb81
SSDEEP 12288:zwNdWUWMDtOyYuvKFWTK5ziGrnWA16IU3etzoN:zwNpWiNtiMTK5zEBz3Wze
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061
Size 32KB
SHA256 817dfbbcf0ad3d648501f1a37f516979674c261866ba5fbbea193f5b730510d8
MD5 f056abd3b5746a1063c0ba5d17a261a7
SHA1 3910b7306d79c00d53861c53ccc098e412018d91
SHA512 9ef167a333f878aa662acee5ac5f717cfed87df0eeb0328bfe79060217e9863a3e8e87f7834a0c75bf4ae854fe94d66c7cb2dcc0b6154202569fed1e23ca227b
SSDEEP 768:HEA9WhBFTLVvajpRA7OKpHoUOXZAj6lkG5r:kbhBFTLV3HyZtkGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 7306a084017e431742136a19dae36ef9bb6acfb96d3b45ed957fa29517cce7ef
MD5 b71752225506ba0cd9ac13e7d5522e94
SHA1 b87fc1da51bd465610f12001007dd89b8c1e450f
SHA512 b18daad1c0ca03e7f814bc5eeb25ddafdfd350fc6df74e0001d0cd93cd98fa436665e4df8298fbcea7a5d34706c267ec25a103cc90592b8ad470cb44f416e214
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c26e039e3838d54606cdf20c609a28cc79c048caea90e92de25af2f6a5678884
MD5 71ff0b2c441240179cdb338d01d30e7c
SHA1 6746d9eb74b11a0fb5c340ffda49616e9d455e8f
SHA512 2b9d456a53afcdaba59b706b58c9e44c531480e8dd92210faf80284ab7d687bb2066af361f5a6ea8620c20329a16044c19bdaded06d5c70cb31f5be1c1a1f8b5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75c90f7b6de5547dbe24bc184779fd9289e94ce171f4df9486fac3b7ef9b4e42
MD5 83969e20e5711a76fda8556010ab0b55
SHA1 83412c638572b3e32c71cb0c0ac303ad25066f56
SHA512 d5eee7d20bfac279df2e995b9ba4c3bb9264c8769cf810cc7d243f1b6f35bc0837cecb1971ee9250a666df9591f5da74578faf7ba49a2809c72fcae9051e863f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d846eb58abcdfb4ef7276ba7913d72ab73082311ef858c29f4494d42e0cf42d
MD5 9b301c0a742dc077436ae3ede8419592
SHA1 ebd51b3b25d1feb70ab20942d9e4ed19cd5f026e
SHA512 56c2e2ee82a1a5d514dd0e19426386e6e3ffaaf87c3a4442621662f7752056452ff0033d1b80c8aab773ba96233d63fb736761fb2f6cdf0e0519fa6ff570bf69
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 cc9d1b633c396708f4e693e54de3568c836da45a8addf0e2a592f2c3872edc3e
MD5 0f83bf29d137bf91632330a57226bc46
SHA1 5ddd2c811f496ea1e287394784fe51e8a0a96191
SHA512 ec735cec0b1611ec68f7183eb64cc52d43a565bea88b74d8c9856d63a0721d6f830a076a3ed34e6d4cd12f72fb7eb9606a3c7208d6acea4c502a0f70321ea88d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 845c0fd31886727814ebb8558417bfbb59882580489caa4a045ef6df3f19cbe5
MD5 fe0f33ad728c548f10120dd0d824a626
SHA1 602a57be28b03deea192b7c09b132e1a280aecaa
SHA512 336f8336b7b552b2e1e28b155391b48cceca752a47615378194d45aa1af617801c4e590feb766262bc2029f29771326e7b4ee367ac4281bb3882a3ad9bc7b078
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 d7b5fbaa19b92c492a9846f3a61e47ae826dac35fc0e4db7c8dad041b4e9c88d
MD5 fbdcf483cf7e773328e02985e2e4c8a0
SHA1 b0a5402ccba33094421603593b89f2e867638b9c
SHA512 3e7b8bafac1eec877efbdfb93f5405bba2b8b1431844643a48cb0a15599b85b6b3896f3cc7babc1d3c2c54bc1490d894ecff9085b797af372ca1df2f2c15b7e0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 77c0acc6cfe51f6f94e710d1b2c9ab6f689c29c5761ffd0dd28ad2b5fec4ff52
MD5 7c6a805325a31b3489543fd86d147173
SHA1 b57248a61a34e51db596317bada25e47a546202e
SHA512 fc96796bf82eb3d9d010fae8f36bc7c59f9476bdd9aa0ab0f871fc590ba676b4dee57ecc744e639f6068599fcc7d935d7b3d8c0f399d706d678437077e7da180
SSDEEP 96:nhkYy1jgEwpvWMoiVmdeHdpomeUWQyV+VDCziEwb:nhkHtgEGWMX4pro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 50510a28b6dbbbaf4f23b74fb45c57734b2d82dfd03ba689ce2d3b96141f521e
MD5 b3432c66c9e78ace1357fda1292fb908
SHA1 17954afd525c2db912419f690c46ebb31a5520a1
SHA512 6ad36060930b853ee90c31cdeecd89a8e4a3f07dac645f5ba2fcda8db28828ff6af01e57c3349ea5ced6288430cc3fe675c0bb94c0a27f44e2733c1c1ab8b00e
SSDEEP 96:nhkRzy1jUSwpieMe5WMoiCR5mdepwnSj8wzjAtV1BGg2dpo+zeUWQyV+VD7AiEwb:nhkwtUSly5WMCXwSIwz0tV1BL24zrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 87480ba54d2fd2454f414eb5ae81ae978aa7b3ae8d18203087e48cbd51fc6d61
MD5 70c5e9b5c9772c04c01a315cd7e8780a
SHA1 278c95cb65243a4d6c907100448c512155c63940
SHA512 dddd00325dec4c9639aa92c0cafdfccf75e85250f31837fdd17b381c87d34591d8cd4fdb84c6d973f74fe61520e86fec4c24a5117c0c9a27a52d1170e44c6d89
SSDEEP 96:nhkRAy1jg0wpO5WMoiVmdeju01jdpoBeUWQyV+VD7AiEwb:nhkxtg0J5WMTu0h4srg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3414d91abdd6dc6c4ca573da01c4bd8971755d72745b67eb765e0a75d66838c0
MD5 25f547a14e6bf775f2182112e83c8f45
SHA1 a450b776c66bcddea794829da40cb46407e42304
SHA512 81a5f09536e283cd691914d99ea14ed8ce97ecc6f24b11c00d0600e4d792680ba2463af90cb752b85007648a41fb076421f725e96b12f1d3766e3e62548e2587
SSDEEP 96:nhkRqy1jUlwp/ll5WMoiVmdeyug1uwzjNdpoBeUWQyV+VD7AiEwb:nhkztUlsll5WMiugQwzp4srg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 47b35445ebc7d76e5ff423359afc31d9751bc26ac7a48351e18e5b08326067a7
MD5 34ffb98f04b7d4e98070980c56ff3bc0
SHA1 23d61478ca6f5a32a04059e74e17a473b7c5dee2
SHA512 aec6954ec11258bd5453dd33fb3734e0f8b8401f3e6f07f48a8f4f4fdb546581742fc152f39bf625499b43b1096e802e49b629c48c21adca4ebcccef3f671b4f
SSDEEP 192:nhkwtUzKM5WM+eA9KBwSIwz0tV1Bx948rg:nhTtUXWUnvyVk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 03063eb3be5387ff1e36b1f3018fdfffc2d8cb35606ab118f06a3f904d9c0cd3
MD5 36895c1be652a8772bdeb7cb9f98bd3a
SHA1 f5e57c4ec249ef885b89533a4be9666344fcc1e8
SHA512 15319a4bc72b926fe45ca40a5d131b2041dcb5cc7af679514e675aa57f457a0f154621cd8ef99fbb683e84bdd17814c690d12f7892aab7b14407675a8fc734fd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d97ba300a80b5c2acd9322753d0ce08a71260ba40aa33dfc39cf60aec5be4fc2
MD5 682399a9e585cad97c83441f440b1710
SHA1 0c8910b74db3d2ad397900341f56f8d180578a69
SHA512 3d60b58b74cb48bd03e2424d9e3ba99d55dbf138002219b2b71b545fe57b06f0f2a7fb20035017f01c616e14b6b71673c2d6cc73d0065b078bc7a8169704a312
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1a99e65cffcc71b189f7d7518c9f3487d290021170a975c23c1c9282a9187429
MD5 9f55fef43a725936dd412ffddd05fcf1
SHA1 b3b1224bb864cabb9b3b1470c83418e8aebc4a95
SHA512 6e01fd120059268b137c0adb4579345a3a5c2e7dbfc65a881221d7d47007eb3ef47a7359b0c1ddfe6f934867e9d48db48d6b0d896e5306a274586118a782f154
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 941721864500ac4cf1796312cc6eef3fbdf1c2268a86eb636dc7cbc405b91b95
MD5 844c00618d30ff486bda0f1c8e18bded
SHA1 6d8fe803af3a51aad401bc916cae51d651381e61
SHA512 cbd0c6d49539fc217fa5d1786015a1b83a5958432aa3bdf6e401b99da49b8aea1bd96368ad3cc4c4b6569c09b8b88591fad45b12806a278435bc6751acc79dc6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 55670d71561e3d99770ad523552b5dd6a188520c14a647a4f7abe8052049c6dd
MD5 d628057c64abb1d5de3044c2a113745c
SHA1 b3d850b7697d81eb096fec90dc46ba21fec120e0
SHA512 c6be65182025d77179a129d034dee9e8fd678940e9533747cfb3c59a69c621e52a0c9b78fe8e0192475c3d661ac0a2f8e951e56a3e2492d626ca22ecf4e19271
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 35d75ce60ed79763c669099a8410cae7d04cb5c0b52d357f85f605c973dadef4
MD5 5af56dabcf8d198417f7696f9a804e77
SHA1 879a343f84b13ce966201248c910e1314443ce67
SHA512 c91bd6362b92ec89445e0e5ec995ff3a9e8762b2f760888bae50d034e6833724908c2c85bd97529eca7b6b7d0cf57f369a549e173cd536f20cc0a7302e626d2d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 16c6fd417e77a6331919c9b4f67214ffdc9e4156641c26dd481d36584c7309c5
MD5 529067a553aa6e58591965c44aae4bb2
SHA1 1100aa082fb7b8da8c974713c9c07c75d0f771b9
SHA512 1a863d67af46d7f19f96910e75f891146df8a91fb1a9ba16ec16e5d6a5b6f1bad2aea6e798963fe74b60ee681a0a7bb71f2e4bd92f9c01892b82cd2caa5726a6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 7be8dc417b99b566b76d38ac0c218e2f999866f2d5ae35df548086fa9bad0d1d
MD5 8ac84f8e4e91eaf250ff8632aeec9809
SHA1 7ed352312065819a36e8c5edd2f08d972edb2f46
SHA512 b6c110c5ad4bbf7dee16a48193f85b333041ed5fb1b62bf3cf2ff2efcc0a438026652990f331b95380cadf6f0dbfb3561049933cd594014859a9d3557636d39e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 7ba4b91dd8a241c586395808ee2ba65a395e638547dff3040c137a84b77caac7
MD5 e73bd204edbd4e5033d0fd6bffd89965
SHA1 4e959d68499e410a6d26b4a1536a05ff1cdcff9e
SHA512 5a9409bb58d399f1ec9561470f1057ca9959d7676e8763fc3e7de69e0f03ba41a6f92e8114be3ca18648834a9dfe5fb96653d83604248f6ce441ba2fc4239430
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 40892cc093f930fb0b6bd3cf5ed7b89e0cef9debf5cc72a3d83554e9fe981b2a
MD5 a9f2aaa3fcaa335bbfe2cb38334fe72e
SHA1 97997b6ab8dc0dd8f1d640b9861eb7ddfc9bfd57
SHA512 211565a5c2e7ef0fca4e22b9fc4d40bb83216354db969534fc88b0b0831da686d6de9da97bf9f0f198aa74ac7dc2e8d3ee58227ede38a70e6674e83771f70689
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 e2d6928248300eba3a0eaddd000cad943da37c5670d65e9423c0cf31c2d3b442
MD5 7414752de17eb789445a1ab56482b626
SHA1 c22b5f9e94005cf70fba88c5d5a07126c7b09cbc
SHA512 507d8646e2fcc1bc946f4f741017362725de9492bf1b3c1e67d10cc4a346e3cf6b7be281d5b4d7e913d5077232c6d0c1fe021cc27bd48439178b49716c4c0d06
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 26de0c8be247e4ff3d77c4d7b7359d698795faff5be884583deda543f66512c4
MD5 89548e539e61fc484ad9c92427bf6f69
SHA1 8cb028f56f9dc11d4974954d2784011b853a65d9
SHA512 520a06d162282807f5ebdc71310af0041509084d00bd3168db696f7a305647ec683b0885833fc5dddc594614ac68a73fdbf4fe9aa5f3ad5e0a8d33891b10a6fb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 4d2656ea9e1fe67817f5f47803593d3f2b804ee61ba378b131fa68bc1a475489
MD5 aaa4a7037210f97dbbf5a6d9a97ff849
SHA1 d29f76d271be296368dcc3cbc1e09d08976315bf
SHA512 87871bdcd9451dd57436ab814fb58028529edb90e58593ad6318fbc44e06182db6b0ff0c1d46c80f922b959e70df7aed2a04271c72addb4075efd5cc45321e84
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe589b60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589b60.TMP
Size 204B
SHA256 277d15c91f6f443aec8c274f9d88705a481c1af54cb3a6abcf78f33aaa4346d5
MD5 6aa79d61644e252cbfc86543971e4d68
SHA1 c5cd1a904d5c8b2461ef6ff66b5f7c2dc17277c4
SHA512 2b72b8fb80b2170abf131e87d428b023645d8a9145465b73fe44756c31cbe53d05a796708f77a0a4286f7ade896da5fa354dbd7e009a6d5dbbd7e0e72bcbeb62
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download