hxxps://edpuzzle[.]com/assignments/672912a0db75771690258674/watch

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://edpuzzle.com/assignments/672912a0db75771690258674/watch

Score

10^/10

google discovery phishing

Malware Config

Signatures

Detected google phishing page
phishing google

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
208	drive.google.com
209	drive.google.com
275	raw.githubusercontent.com
276	raw.githubusercontent.com
277	raw.githubusercontent.com
278	raw.githubusercontent.com
279	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4576	msedge.exe
4576	msedge.exe
4240	msedge.exe
4240	msedge.exe
6104	identity_helper.exe
6104	identity_helper.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

Processes:

msedge.exe

pid	process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

msedge.exe

pid	process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4240 wrote to memory of 3540	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3540	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 512	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4576	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4576	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4856	4240	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://edpuzzle.com/assignments/672912a0db75771690258674/watch
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff998d246f8,0x7ff998d24708,0x7ff998d24718
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17831307345214574271,51298415825150237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks

Filesize
1KB

MD5
338cbaeb09de9150e50df5a902be3fef

SHA1
ef279a2e52a56df6a45bdfcf7b7bb2063301e5d2

SHA256
a2491d5ebc47aa2f704f2ea8f3a5c582e83a6f444054b52ef85f19b0924c1f45

SHA512
e4a46c9ff022ff50684a66631ff209bc7d752e493e34dd0aa1167298a8e3f4a6ffe08ec97e668b6b26a1bc0a363b32f20f7c1061669979ec277a3840634d1012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks~RFe59283f.TMP

Filesize
1KB

MD5
16ee1afa085d9afdb85655ac1d42e9fb

SHA1
672ff4f804d5ffa2d15102c5925ff47629e690ec

SHA256
4812cc3c830833312616b19dd09d99806966a6a6c13f2b1b3724c757c39fce80

SHA512
02b5946cad5ebf3f8c6b65fde90b2e925b55916e78e071997aad8a160e4265c50b1c45d74c0094d34c8ff7d06697a1ba6ad76df5300bb306420ff1c350be3c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
406KB

MD5
d8d10106b0d5a8776dbbcd588350f338

SHA1
52b86f78c6f63c7093b45532b24d6bf62e910138

SHA256
825c1a9aeca11a649e1f0f60f1d51489bc00f8d2ff8157bc2fd8a3e0186e0fe5

SHA512
0138fa511abc579079bd53663dbc86f633bb0bd30cad0da8d04fc771fc8a35c007f7209c0e5fb3e47bfd938e5f5e599ae945c9b974b7ba05c1a24c5d8dd36cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e21ee69a646f50ed35714830c37cbe50

SHA1
726fa26755e72976ff1c856c0a01d52bdf24fbb2

SHA256
ccd25a9215ab884028a83a905ecdf8f5eecfcf5475534cc85e46d6786cf965a4

SHA512
d12319806c574881822ef0f99c9197851ded3a8299d17dad3efb3a8e6cf69d5cc750ce28107be442e2e5120cf2a5e236b4bff6075f07f926f38254750a72e2c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
621c761a37ca32544f5e51d4c8efa63d

SHA1
f7cc4505e528feac6e76e1bc5e324f38b33d01dc

SHA256
8da8a3458586280806baf147bafd185877ad70ca8bb93b1be0cce40763a8cce6

SHA512
08fb266eb2be85b6c745f06c299bc0290009c4d691a4c7e47a0e489a6a95fe2ad5a7eafe8f2df63326d827c12407ec6b07176022fdbeeb2a6711188500a49b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mail.google.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtubeeducation.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
c14f691411de5ca71873899c1bbc9457

SHA1
da92ced567cc966111753f1b23c1a22146353cb4

SHA256
f899fd036271712ca3d04a7b2a62eed224a256f40edbb18dd008c8f05b75e786

SHA512
f4e82aaed2073e0a2dbd321b854e91cd135daeb2492ab37c24b463d0fe3f6919c32c54b9a5ae296a4f100ab26faa9f041ad3017bda753bc30999a7b6e9dc0829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
90f6e0962057e68d98068dab6f13aff3

SHA1
6802be9a716a397694880f3f47a2b6564bc0bcbc

SHA256
42b3ffb8f9892b012f648219d1dfcdd15273a1278dff34dc906f0ffc7e696b53

SHA512
58c76776515566cdb9759ad44a74493faf9db46c54973defebd1c7047d9d35d3a30b04236d41596c8be0b327ddcf8c059545474baf28e15a1da73f9106fcdeb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8636b645e1daac43348fc233ae1b69dc

SHA1
e5ffebfc57a19c026bf79aa9ab594479a0021aed

SHA256
375e5dd7644bb91dfa16eae8dd2cde6f014608337cf78921f652cadc36a8a02f

SHA512
e92629c4860d207991f4a9fb5192b8b4343da4355bc52dca4b3ff9e38666bf02d9c438b3b19ca6c7e6474dccfe07322ca35518d38a855e777098554bafe59595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6cede541d22b4cc7fb5b9326ebd2382

SHA1
2a6614f3aad538c459b48a1eb1fce78a6c72d38a

SHA256
feaae5b4de2d50ee00e81e3c8f5c97bdd5a5f6e780ee38db89b228024dfb14e1

SHA512
e3515ee2158eedbf277a062482f0e42d9f00a9169f09acde6e03bb2c5de64c26b789475b28e181bb7ec99473eb142c8bc485c1dc9bea4cf5f8c055b186d601b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
08fda40d27a65a831afdb5319f0b39f5

SHA1
f54d0c4169bb92521d6d68dead76bff131dcdadd

SHA256
f6d41e27e81ae5371bb5645e318b08864be51f442ec72d219b2e4245d3ff1cef

SHA512
50caacbed1990ea3081014b723d0ae89b1d89e6b36e47bff12bd7b4233078fb199277abf454e3ad0afa297169848ef0cd33736af6bdb9ce25cba007314aac221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b04c58fa2c537c3a3d1a9e65b4b297ed

SHA1
cb57533e7cd41f9d12afa601c5e38d4dc408c72f

SHA256
f6129bd62fbb3f8e4bb15fc4f55904412de8a551e69dc33f0f8d42082fd834dd

SHA512
50710bf1dfae5a35d78bd0e7df8a84d2c314ace2c838725ea61578255aad54679f8dbd91fb5e0561b8b7f16450374fc966c90472c4919ccac612e386577c54a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f8905c91543eef1d183ab0950d26ba4c

SHA1
00f230078a4d4059a7bdf01c7ce6776ee8d66d92

SHA256
c24f2bd324bb1ecacd3e443a411362e8898eea877dfdc0c182f69fe9f8895225

SHA512
a92bd7e2a72f3b7627aa876adbf80bd9fce4253bf5e961497bbc9e8646b49afd257e6f9eb2f3f1d3f4cace0e44fcf1169180118c1253bc1ba3f7bc6931248bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
438af3e792d4ea42a17562c5828466ec

SHA1
e63d03a27edb1257bda199cff49107776ac6248a

SHA256
ff85db8b527bb5ce4434af6767b3b33457a2442d5b586a53ecd8f93a7e455363

SHA512
61dd3dc16d4c81b46daccc3c0fe00d08e44aefa8d341f227f5937d2fa7fdf43ab94cff5caa77e5f09890c567c52773231ddb8c23ab7fdc89d940f5fab28f60d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1667d02d36f6e7bea43465d8755c9ba2

SHA1
6712c03e9028a1de3c7bf9661bdc57a6a579338a

SHA256
1fb91574bc6849211b72c70349417419adfb8c40bb69cc1959b804574c80b2d9

SHA512
22412f646a458e116fe75e82be3b74d54dbe4e2d035f5ae551c0eda928b2d7c43e41230440d6469ba48ccabd6e669f26fcf11ac32aa8e77a858659b8e31052a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\04ff1455-ac15-4b5d-8ca8-1cb323b99c0d\index-dir\the-real-index

Filesize
72B

MD5
89f50ed8e1c64bb15a07eb1cd6811f01

SHA1
e87e0d2a524694930174aeb827488edaae10f691

SHA256
b061efc01614ad67841fe472a05280555ecf0ba21e364f0c5f8b248aa3c34a1a

SHA512
7f0e8c1689c92c4bc3e5b95bb4b21c919487f6ae3b5922a411f9725a73e132067a7630511d336cc710f614c3d9964bcc900d0cf9b5ddb5aef28056f97d361b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\04ff1455-ac15-4b5d-8ca8-1cb323b99c0d\index-dir\the-real-index~RFe589287.TMP

Filesize
48B

MD5
0f7b4a5274706db54ae8bfdcda3be842

SHA1
741ec0643358340022c651d987a98a297e145d97

SHA256
e7d8b063608712d300a0dd7b6d4597eec85b16ac08131b2769ea0e304e31b8ae

SHA512
237315bb962516a4b8701ad45c28c97ec607ff8b779fdf0887431957c0e420a87223045575c5c5dbae7958f1c231a1771d4628a0e83461fb08968738035d3829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\16330a62-c141-417a-933b-326b7ab0660f\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\16330a62-c141-417a-933b-326b7ab0660f\index-dir\the-real-index

Filesize
11KB

MD5
d5b018bd078496fe3796652fa1e8a926

SHA1
5171ec5da70b79fdb6aa30cecc10b3bb1fa12d80

SHA256
a405e4fd7d8f4bc80a5fe1dd391186bbb0a92ac969e265e58b15b4932c3e86cd

SHA512
b379c1245c69ec8129c0dd53239140212803a636cb5737817169f609ca572ad7fcafa8eea00c3b65b2963b743512fd048b95f532df1836a734bf07ec76734c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\16330a62-c141-417a-933b-326b7ab0660f\index-dir\the-real-index~RFe58d944.TMP

Filesize
48B

MD5
c0091c133bda4dc1833220c7126d24b8

SHA1
4f0a95441dd0d57a052f8974896ff4aafe117595

SHA256
9b38c0dc2f107a32de4a764a76a27a66f3134099887a99ab7e4672e7fe384ce3

SHA512
5b6eb7be0d1f66bd8ee89243b48d5a338bf45a2531a199e506212a3b3cf0bc3532bcbe6d25ed94c51c10084bac6e404506a6d856f44dccc84149431577622d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\d9a3b8f1-8587-4b73-986a-c085feec6d93\index-dir\the-real-index

Filesize
144B

MD5
8c36532f92d08a58b6a17e55e2ba5527

SHA1
f8d2d438f1000183d99b03a8724c37e02c2d88dd

SHA256
a7140e9fc5b84eb6d5a8673e163c499e67e51a25b8c7c0b526b523f19a5e056c

SHA512
d327ff0bd14b2222c44f1ebb5e958006c085c87a2242c460e5b70e642316faa793002be5a91f019d6daf33b52b555b7c6a4545c80f0d882e6a3a78ec6e1ac952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\d9a3b8f1-8587-4b73-986a-c085feec6d93\index-dir\the-real-index~RFe588fe7.TMP

Filesize
48B

MD5
0528cf83a465dc39f9ec2c945eb186a9

SHA1
433dfce47b73e47750acef8ccd84d1610faa31c7

SHA256
acd243cbbc4c74622794bed4f320227fb1cd334e00c87ae13a908175bbfbce40

SHA512
bdd3edbda10c7d74f84e8e77b0a5d339fa769622ffdf652d91061b853f283f1579ac43e35f4d55787996d69d7bf1efc3a535fcbd8b22f9ce70aadb99444d4525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\fef99837-f98f-47e8-a0c4-ce9586446168\index-dir\the-real-index

Filesize
120B

MD5
85763a3d87d7cd777ae8290166a4a246

SHA1
ef6c6e33f891634922d3d3bf441f7d96adefbf10

SHA256
f1a423bd05fdc8d61bdc8e955f4b27a4d01bcfeb27b43118693727d22a514a88

SHA512
6ee236bf025d4817e675d6e6d9d7519ac6a50c7decc2e2d1503f9082b9fef64f08da8f0ab31fbdfb7b0c16e1fd9841e9d2bfd16f4e3e10f23c1b3beebae173c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\fef99837-f98f-47e8-a0c4-ce9586446168\index-dir\the-real-index~RFe589267.TMP

Filesize
48B

MD5
c8fe6a7192708d184b0875a19cc247b3

SHA1
f5458c694c8e810a97a7e85810030e2968911397

SHA256
ca1cdb9689f22114f8f6f535e4546f9dc7ada6c06ac48373bd604436747155e2

SHA512
29efa54630736120e1c895498814e3a9496f273762bf2c8f39a2a209e0c479f918e240dc0cc7d33ab8fa59e02f045a0920adf4a1d3207f2cea0f741694008f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

Filesize
130B

MD5
c7862c0789901febe8df33c155d37564

SHA1
ef3386bf6860d33096ca4403edd49e9f3eb63094

SHA256
61da1be14ae65f3a6392db10e193b0341581ca1b85b8263e2f9d231751c4a300

SHA512
2247c8857824034f2d0907748b905654e1a55bfd5256ed11cc449660d7eb4e0db137db4637a33654d5ac889463b5bca1f5e172ac0d4ee18fa4bd135c20e78571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

Filesize
226B

MD5
e6dd7bc6bfa6159160cbae30159c08e8

SHA1
899341cda61c63ebd2d0ccef5ec80027740c9a17

SHA256
2c1aa08013fa1c6576bfdf58c8c4f38d6a2bac8b37fd4aaca1d5ce6f5b04cdbc

SHA512
e9e744e1b04ac78a3a743e108caa4697a0f209a73e41e35d2ba2efde33586e42a705e96c1c92bd998aa714997932b4e0190d4ebf6acc879d02a69d86db1b67e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

Filesize
290B

MD5
f310edecec9c3959c948f2f5638484c7

SHA1
d61f5a74df9d1cdd4c5ac760dacd2d5b60625799

SHA256
2d2426226856c54015480768665a0f8be095d8bd547bfd67c059624c703ac238

SHA512
b998f46aa2e5002a6ac94ea62192df5ac41094034108397a4bcad5e3d5a38c95dcfb17bed82ee00c3debcbead68a5f77e52b505f72ede7abf97cd356c3cc6e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

Filesize
359B

MD5
b62296e31ce077369065668525f28a3e

SHA1
c81d6367a758ac8ef8d48a176469584e06b94c19

SHA256
ca74cd89d5968de81186338d1bb0474eab6e0b407f7e18176e3db5e9b2ca26ba

SHA512
e10b975854602f1815388d58a80deefa496acdd258bea934eb7e3639050dc9f124951d12cdc1ba411ae88724f77faf1561a108418cb860b89c6d63ed30e49e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

Filesize
354B

MD5
9074b2fb657373f6c9cdbfdce6cf0f34

SHA1
b6609b265f99b9e357efe0d55ee63bdc92aa2544

SHA256
58e9e7a877ada8feeb4e8d3f36c81a7bdae0aece86bdfceb40aed6c2d00fa6fb

SHA512
f52d9ffe700cbb3b26498d77d32c0973f8d3d4f44eb9cc8050e5928dbb04f3614476bf663df6a6faacd1311acd76ff1c129d384634035eeddfc56755cdc89851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b83df0e93fd18ff75bc71615a01bcd30dabd5704\index.txt

Filesize
35B

MD5
4e075fef575216a5be604ff489007bc4

SHA1
07be26bf727b123395be443a9245bd10da60ab12

SHA256
f2065536beaee87b9034834258cecb9b53a30f0c61efa4749583ff59c5e79b64

SHA512
7cf1df56abc2e10d8785f387a0df7cce9688c6c829c467d8a07e2edcf64d2ce38ad3bddae50cdfa4c81bdf009501ff4dda0dec9096c057ab5a452a0b2391c292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b83df0e93fd18ff75bc71615a01bcd30dabd5704\index.txt

Filesize
99B

MD5
f17b196f8d888e75c39043c15c043845

SHA1
98be407f43d280907055064357508ecdcfae955e

SHA256
fbc46de7e4dc76f02e4ad12535655b05004a069500f1fb506d1332011e17bd54

SHA512
8b7a132f1327f1d86fa49fdcaffe804fa3b794e005a44c924a09d5f0123bbc2dc8e1e2c4812787fc584a2a4f35f5bafeb4ec69eb6dd6e494eae54095a4fc206e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b83df0e93fd18ff75bc71615a01bcd30dabd5704\index.txt~RFe594368.TMP

Filesize
99B

MD5
3a3ebe2b5558015cb03815d88b6e9c25

SHA1
46fdf89e24d3466f88030afdee3d1dbdbfce9d5f

SHA256
a73af970f5f3dd32872bd99ae1c954c4713050e4f8fe8404182fa5d094db7298

SHA512
fc3b10bf4e6cc0859125745b2f2017f64fae4e5da4c1d1bfaf8abb195fb083155d2f0fe24c971390192310f3a3cb1faa4d1892fcbc0ddf4e4d61729d5a9e8cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a941646a6281d3cdda9207a068f70b81

SHA1
56eae809fc66c5e191f0c02c81d8237dbbb832d7

SHA256
92b49855147e1375b869908b0ff051d62a75f53967ac568df21822045587f02c

SHA512
00a381f731910a6b32e6b026c6cf7c2545a2dfe0421e6ce0767e7721a28378e368489caf3d2466b5a863a1b0a1259fae5e380b39be1309f2a9d0d8e06115e29b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588c2e.TMP

Filesize
48B

MD5
8ddc29e0e843d7aefaf131b53b4bf587

SHA1
d1701a35d0dd19009f92671c6f8e92b6b2acb69e

SHA256
df73b9ca531439f2dcc9e1e1559581fba4c327a90df2fa0e913e600943391cf0

SHA512
f8b504f8204d9dd0a3af35e161d1401aa4c1bb207fa8d3da2de1ae3ca65b0825cc4ddadab3354340aa8e861b86eb75a4bda69de493c06b99e48b2d75d06aa240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0b281cb107f9b3c28d0847c7a09f064d

SHA1
f69ec7d2604856c24cf0b59f8a76d799f5f0c608

SHA256
22e9ff24a9eeda9e43a320bd9dd2907ff13a7177e47cbf2157ca5084222d7850

SHA512
794e3a29cf4f3873407126adc311257781702ceb00a19c794f7f084f536f19fb942b9610615e599149d3d70f6457358439827adbaac6df121cdd1ccca7a9898a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8f09aea19a9acb0c534b192e62f2c18c

SHA1
f5e351bf87c0ed0f0f32b241bde13c89d484390f

SHA256
0122162d1a463c673bc463c16b8ab3702e132c24f02b9b3e40fd6893ce68251f

SHA512
e41fcad0fe7a781e35513108affa5e58fd8ce0c4465ebc7d7af8b4216d1cdce18ee4fbf454303f270e860196875584ed4300556eaf35d81a3793e2b37c42e193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
658a8239bba9ff00b1d75451d44ee0bd

SHA1
3e8bb3a5e230fa3bc950ef590b567160aec66b5a

SHA256
7932cd50e6e2de98b207163e4dbd1720ca4895c0e17e0085d0c2cc68a722c25f

SHA512
c74d9beab43fdd16705eafc6fad6b4b710df2e5737038e5accdc67afdb60d5e65ea8c2c80615987b7773d41ecaa624491d3c1b680603c8f9190ab2862ab4d11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
93dd3caa81c3b027b172d9c60eed9756

SHA1
b900ae18231ff88b6581802eb8e7c39e14d1d4ac

SHA256
a4648830696989046e8886a4eabc677d183ba7bdb5cc9714e0a7b199c398c6e4

SHA512
bf92babbc07f9a0adb6e84ce8c960f0568e22cc27fa2a978c35b388e084612c2dde3f7bd3a036377199f129b852c699ae0b9dab80f1a7aea0e14022dffeeb5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3945de1e3d94a902f62a900327f3b94d

SHA1
3c84d777ba9c284031de46579f84dfc05c983951

SHA256
1ab278d6cf950d066c0a63337a265ab6e638bb4c7312918cdc8971c8cde34c5e

SHA512
bea8a1658da59a62f632aac1a0d572e2225d798d8a8194a9835da4845daa50a143638115b3bbcd293b179cf4502f9b33c2c6c57091b9110f3ae14053b286abad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
60d08e066dbaaff13d14b980e0cd25b1

SHA1
397a8fa6e9a7c0a95fe2d86040752730ba07b9c7

SHA256
47ca4230a4b2168ebf1bf8e812c98b57921542441fbd0dacdab02061494f77be

SHA512
e0a1859a9874e9b716d04e6d63713cefcbc65c286ac715e0d8a22d5f5435997a97dd79743f3f2c45e520aadb3bc071d35cf391e995f39b535776782e71495f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa14170034bc87195bc07fe7147e9528

SHA1
d86b33dbb88144a53e9156695eb4d7fb1c96a03b

SHA256
ecd4deaa0b08505d509b776396ff8562fcb23251d5d86eb9743dcb5d8c0dc39c

SHA512
254b58bb0df8ffcefe1d6378f790d86eca61b8ed885ebb5d2f74b72bc5d58ef02959a5c44c98af95706bafff15fcde67a24c03d637b2a30b90dbe02fe5a62528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
aca573187eafe80ddd4507a5702decb8

SHA1
02296cec6fca5a6e911761fc2357223bb4898483

SHA256
e0025aae39d9af461c1003450b48258b30f5479cb02ffde08774c433485757af

SHA512
b224d907f26ffb094ff619c2b4ef3ed52012d85463986e2cd5b9472355942b111d4789f2db1b58b288f19ae13623aea43eedd4bd8d82a7ce28e543693350a17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d6d334a626eea52df72f251bb1744fcb

SHA1
09276c83cc8ae4d402099d4a1e2c8e97cb374a73

SHA256
c7f1a634e9bcdf8e3ea6de36bbb891cdbf0984e52f770d8de8305f2e8ecb8890

SHA512
ee96b2c90a7f092df7ea7b20f4f4e058bac1d169adb526d037245a14e97b4b83bf646b708eec4e6e37a32c27c8bd6244ffc4c4682907ba9aac1dcb4af50bb0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8b8.TMP

Filesize
868B

MD5
2d3aef213a9dd30efa58268460b148f4

SHA1
805d6a7b30812f7c474735dc5f0a89645ec0935c

SHA256
5c9a3552d7fdc89d4664f96754771df70a24df2fabb82f6a108cc71aca67e2c1

SHA512
8ae664ea4259952724ba90ed4cf068df91d2f96db14c468c73c1351cef211b18eb12c4d6452622a3a1498bbfb330031223eb5e4da1d6891ef49ad9b52a02cb54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f7aab1c110ba6f0112c9dd4b336d18e3

SHA1
bfae4dea21eb1c32118d48c03622eb583eb81945

SHA256
a9fd335e041fb7e5cceb8e5e805d1c7a832162cfb1abca980b8466382794de5e

SHA512
0a173edb7535cbf2c5a4e0d36d5c80c7d4e48f9590a950fb029fa729665ef6ff322e41da6c05fe381f100c9d4e3c591bb5fe3cb094e9ea2ab6e720924dc9606f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7cd3cdeff299c4b4f622ef1c8ee9afb6

SHA1
7e51a086ce44016280d69f33310abd6ab2332eae

SHA256
91e91265c1976725622fb895412d3edb56c36b2bdd547bb98d00f248ccbe3b64

SHA512
57dc402db0af4c19f475e44cf06fd2a1c83168d22ab61e85b2a0acfc6da403576bac9cb72a02b4ee1ca0081285754a152c97ff13867bb30e15b2cf0e950bf876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a3d9da2d78b71e6ce92acbf06d19c5a

SHA1
2fb6736155e9e08a569711c0d31e84b73eb92134

SHA256
f53a76d6ebc15539be39cdeb89061b319460df57c99ddc5a4302416616c1277a

SHA512
8875bf2dc2696a6843ffb0bf328b8ff3a9db93c1097df8301f1570d249f9a868f26f601a2a35f07a880fd287ad6d1e26c805307454684f0580b3cd92e6ed367c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
19053984345c17c85ee9ce2aa76ca834

SHA1
bda278c506c066fe853b2bf887a2c258bfb9e176

SHA256
f79e0533fff9d201fb76ba42b7798db4037e43c69962204181c993533d523cd1

SHA512
51765799e5a0ed3764a74f413325651455853e4584a6894bad40778bddc306406373dd8a8f245e578619fb825c459f03846ea21975e45a3288ddee67d39fd59f

Download Submit
\??\pipe\LOCAL\crashpad_4240_GAMRVSMSFKAZSHDP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit