fab320941a27be2dcce314470f9df44e72e3fa96432900a0bb5075453fda384b

Resubmissions

06-11-2024 06:32

241106-hawghswepq 7

06-11-2024 06:24

241106-g6hpvswajf 10

06-11-2024 04:29

241106-e4bsestnhx 10

Analysis

max time kernel
212s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script-mad-city-7.html
Size

7KB
MD5

5d35c07aa73b879487f5f582f1eee2f7
SHA1

9a239070b40e8a8d6fee6276c9bb4d7baf3267ac
SHA256

fab320941a27be2dcce314470f9df44e72e3fa96432900a0bb5075453fda384b
SHA512

16852de31ca0c9f5a4618cdfa2b113e2866ebca07c23fa8faa3ce13013da9ecec138df63c4043188496585f774abba0e81766cc26c6ecb9cc5c72eaa77388f31
SSDEEP

192:PN2x2Bcu38+G1YCdjOGC4bdsgW8voy7m71TyPTN:AxHu38+GO+OGCkQ8Qy7mhWTN

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
3728	msedge.exe
3728	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3716	3728	msedge.exe	84
PID 3728 wrote to memory of 3716	3728	msedge.exe	84
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 1464	3728	msedge.exe	85
PID 3728 wrote to memory of 4428	3728	msedge.exe	86
PID 3728 wrote to memory of 4428	3728	msedge.exe	86
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87
PID 3728 wrote to memory of 2108	3728	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\script-mad-city-7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe67d946f8,0x7ffe67d94708,0x7ffe67d94718
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1184 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11047389754891092296,7428356634727270121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:5884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b6f4065-67c2-4040-ba55-1ffeceac750e.tmp

Filesize
7KB

MD5
6dd378c2e9fc8d87a6bc546c1efe9a69

SHA1
d791976340a124ab30ac63fa86170ad8359d4152

SHA256
07576ccb59864ea34c55cdcc38718d7ba9ce3981511640779db32073ccc22e95

SHA512
3653d3c4cbc87fee8278ca83660b7482a33154ec9dc201731a3f4483120e2ca1600ccb25f0dd60ed0ccaee77e4ff4364d0f1f93a64b639c2cb4bc351662b7435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0ef81c037915f392e47c9edb5a07f6d9

SHA1
afa30374a5cadedb3ac20040afbe9aecfe7b47c5

SHA256
499bd63725e6c3be459bd85700dc64eda35b33d078818272aef53f60f81a689e

SHA512
e161773426b0bd8d04261c14c5bd698d1fa87d0c4503c7e12bae8e6ae2e1d1a34c629ef956a8b09cbdf7cf74917980bb579ad8f3a425b7a4486a190853c2976d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
fb2f02c107cee2b4f2286d528d23b94e

SHA1
d76d6b684b7cfbe340e61734a7c197cc672b1af3

SHA256
925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

SHA512
be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
25KB

MD5
407490850a11d4ddbfa8cfc8ca4b4134

SHA1
4a4ef50edd7d20ee11ee064a2ffc4f6ec7929d8e

SHA256
76585e2caa825e3e419d14abf626b43897ebc5ebad8eadebe23fa51bec943555

SHA512
49db102c324cc21339db0e9a0119cfd8281d881fda7a8e7098bf967151eee8b51d5fc4b9ebe4f2aec63c6c0960230d784e9c4cbba51260ca289618cc61e10ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
643c4fca766fe215b8edd1bdb562e1cc

SHA1
b06897c14123e62f841ad1ff6f7c07356c27bbb0

SHA256
59aa227d4568e3a810c70b516e36d73990990fa22ec585d42ac7f49c4e1d11f3

SHA512
fe8e790903feb75b58b0918475a2f45b504a8c2913575ec2c88eb59dcd27bb639d024e9a089f9228b7db66d240b8fe37f1757bcfc6f3d75376b382360ddec306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bca30d64182a52a81eede20efcaf927a

SHA1
50c04b022d3d4f7133e785c7c3e5ab838361c47d

SHA256
c5798690f551c2964f99d75505a9c588d04da6b86c328b1400f3fbac63aa540e

SHA512
f4c6ad727a376aba0c90e6dd64732e6f7e6e1675d3279cd052f89b5a14c89cb9021e3b14100acbe7d7c4a0a6f9507dcbe091c85e13b3149cfb6acc2633fb5795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6676be264af35a0c12f1a70a2ef62ead

SHA1
b3b6d78823cfabb25ba26ec3f3de7947fb39b492

SHA256
3490ea124faf1737769942590c7dd91e5853345f0aaf9b1e9b90b12ad99b7425

SHA512
b15a50fe5d30888699bf8fb8cfd4d0dde07c9bb917ff753869a97177befa8520cb1c30f78a42f8c61a9c1e20ccb4f30aba4b02c20a3d0cad0fc6e54e34c259c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aeddda3634cff5f54d3b9adf2fe2fe60

SHA1
81240e617c9b8fef0d3b6af490a5389124b3a4d3

SHA256
3faa9dc3d018927dcac54f6c4b9cd79da53b203ed2cecd3207a6bb3f36a3920d

SHA512
8208f05f28a4eaf56d959779a68f61a0fc7fceb6c7c5cc044f3da1cefa52b82ffaf8319bac86a60bbe0e6a624f92af460c640a608c58e453bf52484cd926dca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
baef9b4be133a292e063558fcab00c09

SHA1
0c660736eb74b5659f88f1ef4f9833485e01f6d0

SHA256
2da48c1214926a67086954c4b258cd4981916d0eaec365b0f231e585118b1fef

SHA512
30ec220a5d9f675ce5811d4bed5b97c3e477cc73d391208fbe19f474b358450a7006e7f01f2614d8209139140306d42e9c4e2d790a2ddf1f29665ad601102782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
05a9504096f459bb084de8a56ce11ea2

SHA1
ba497f1fc3541ba69f73b3abe5e99c3a3062ae5a

SHA256
6803bc916889360ce04e566bac4ad22de7fca4909b866745f109cea5d2a0a676

SHA512
dcd8b1c62933608f4f259bb022b6a386de3e9e28bbee06ea6143cbe4be93a17c451ab64706b26b9c6990ed90b89307c7f62caa6710ff5607c88902d3ef102f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2cb5d0df9dc9576c8bdc8859a33d6ae

SHA1
bf2d88130d1a5069edd5ca1146faf8cc8b313b9d

SHA256
ca0d6f57790fda6d8c55a57028aa2184c19155256046f2ec32abed358c4c1db8

SHA512
c6c582343bb25bf22a0409408e0edc9eb0327333f9f2233e222d716d0dd0644ec961a7465414499dcca4758f90f3015f4e70a55ad602ad124ce573fe29928e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69988042ffffc9fdd6b109fe5e0ce3d9

SHA1
41ca54bab6b1caebe389cf7be2bc5a91c172672e

SHA256
fd4f1e28dc02ac370d83f00ce310904ba159b5fb03576b64fd512f222bafb71d

SHA512
07b547e5008970a57d0ba1feb7148171506e5163aa481eb0f8040638984b489b8bcabbc4cf5fd2326f38f8dd52c06f2899b0a759d1607435a5a8e390c29761ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
967de1dc257e80f803725aa0954726df

SHA1
5df204132f3bfc6612a0a2af6198231011cca3ce

SHA256
96e10eb2482c5d0b0e8902fd02e1956430ac38940ac0ce1f83f446dd1b8fe6b1

SHA512
69eae25e13fa4ec0b17bd30e325a68213c2a51a71a0bf8af0900db5343ed99341f883aad5a1454ab08f92e2326a87b78d5fc95a7feaa2a004d136e12d76e4826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
331064bf24369308c8ed160b794849b1

SHA1
d4806aea409a25752ae674c886ccd4f93b210e0c

SHA256
e855baca5fd006a09eec0605184b7a61ae100111e7eb6da032e818a813f381bc

SHA512
30fd91b047551a9b8f9ab13f35322e3c9b4dbb17699e3e195431eed5e262742cc53640f25e28f289c3d9538ef7fd00b0e5f4f542d1695a47bebd3553c29fe13a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a58a7aa2368dc1c7559e146726b7a515

SHA1
653da466a7d62a906d234e0e5d9030781335b866

SHA256
d32fcf08c51762f467cd33808986468d0e1ee7c2c7a03837fa2ee77be27bb687

SHA512
4f781de70ec307743b90d3d5613177fed743eb0112f51f49746fb46618be8f953c8a1833d2a35eeae7098151a7c38920e2bddda55a3045c9afb134fcec9d6e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95b237dff01db92b2a03591cb1895f0a

SHA1
5c40acfa7f1eede008c7a8be39f5ecc0b57ee09c

SHA256
b3b6cdfd01eb07aa16043251e085b5a960992e5941ec6670f52d0b5cca1b7863

SHA512
50e17efdbb99fec0568a3169f249d3ee2155762cb2242010bc498bd805031b47f09803be73e82d5a943077d32eaff7e8ee0ad181437c957531273dc695798054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0760ed92602fe49af208a5df020d3f43

SHA1
b2648dc8855a276ea861ca3075aaca9f056e522e

SHA256
d325749ae496e8f907d395f0936606dc2f81eea2db12193789cb510fdce669c3

SHA512
75b950fe41d0e7cb6bfe7f36bef9ffba1eb8dfd22282a34d2c0788b8bec1f8877a0d7b59ecb3b4d541635d5f533c7fa381f7f33c8931e3797a99d34b30211385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
25ac27d404fdefd16eecc767f3a2930c

SHA1
b54dbc88cb1abe81a1edfa76d9f1fde24ed15d28

SHA256
9e9dcbf1ed386354ad6a5f873285988c0a8047db62769802e5223d8feb98722b

SHA512
179f1895f92cc7d392639099bd346f9835190e5a633a1d0d39a9b0e6384941183ed79db02484b2d23d13fae853021291a4d1d5912a0c0ea0688d96f803633fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d637682f02bdab9cc1d9ca9bb6d67ec7

SHA1
f494ec53a85568bcb2343fff0ae7ece64705c136

SHA256
18950d7ec44f3040fd165782643ef3b1d3f1cef4d49e01ec3553f618dbed8096

SHA512
f820740fbed8f3657b8849e12c2411e50c260ac25f2a32913c7c9927825be2b15ce10600e4072e638511c94b35b00d57af58f49c4bfe7ae5fa3aed9bda46cb63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bc008f3aceba90856e2ffd7b240c4e83

SHA1
ceb4143177fef53e0c8f2690a3165408507737a1

SHA256
fc10350318f74fb126274e2724cadf80c2bf2c614101037b6b3005070d047299

SHA512
4224c1303d9c9062aac4f861384a0d5b58f5c0da6de2c876f1b084ae11ba339988e8e28c6054f66fd7d0e96261661ee3ae2a85bd7df04621380c3198f96feda8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cf5dadac5140901fec4ade620b081e40

SHA1
35ab7314923e21a741d7d2d6bfc8549dc672cd59

SHA256
8674f9f939ed7f65a287547907f6e80cc50fad29fb3b6126823f0ef6d52bf6b1

SHA512
179421a09ad5416125f978d399212b4946ad7114057e9b7c9d279c1ddfc64806976c6ebd9ae194f43e2fd57494008ef3599e6bd2a65160d5b22b4d0c3451c660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4b57d9f1371ccebcebcf42735c5c252c

SHA1
03d75838fc0882ea5bbe95ece40814a123f2d012

SHA256
57b5a97b0841fc6d35e02d9e08f2c6977247503e2e8efb5c38f44fb1bba61883

SHA512
3a8c08be17754a160c98e0bce4da935248d0cec7bb0da77bb6afe5403957b87f059102a274b5a244be17a67697c06d28879165dad6b1bbbe0ccedb99fa6174c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583f75.TMP

Filesize
703B

MD5
fe85f0a154ad187d461e5aa15ccdfa85

SHA1
0a0157335d11a69631921ff18e14c6f2f2e09381

SHA256
8739f2cef97cc9767c5a2816388222630ba06067def9fc16f7d2f7178f04736f

SHA512
5cddf387991db2708610817d28735f8708fd7907ec64ca03d2dc80a4969352e96a62a3fd2e84c9be985dd60b3eba430b933c2e787dfc762cf610f76ff0000e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
48bf9822dc5659d2feb91863da67f569

SHA1
a0d782803bb61e1639514030d3323897bffa24b5

SHA256
7931a92a9f3369da585eba035a465628a0c0756e0ee4ad407023a939f3ebf257

SHA512
745d78abaff7af768014df414e38341cbea56ce1c9bf49072e87b9ef3921ecb3ff290175edd154a0e9c10e4149addccf757f62479f616d07b5fd66964306dec1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
e89aa4763dee524805f6367db93b9d96

SHA1
cb65564db7d72da578aca15737264d79538176f4

SHA256
aa947b6c1c5e7e2c4ffb10179d3cd86335d97f66cf097ffeddd61f92aa925658

SHA512
9c1cee88a03ecd7470f03a834c79d8e4a464e8f201698adb8f0fd3236360be99356de62ee8a53e448922d68d364958161c4e9dadfd1d0feac639b88669f7382b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
16KB

MD5
50f7f63592da63a6c05d44268024c929

SHA1
d758b2b7080435b014155b18a686ac34639da240

SHA256
7ca8f9d3e9736eb7e4a227c87d42265186440e6471a61ba2a4bb67eb219858c2

SHA512
1e555c4a84fceabceb6a0670b9a5c706e1399e135bf146df3b87ffc331315f01960f5c5a8b4b915e9f98c77a30c7ab58c06751fbe2e566675cddf7e695ea7b63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
16KB

MD5
a054911815f6b2c3048d3b2e0d1d5a1b

SHA1
e665e188c80f73705b771bd21648d552c1a2e81c

SHA256
25a60d1e180047353cbcd4d2f6b1b5b6b869bdf90931f76e92259f1ded247875

SHA512
434652add0d6ab8323828b2e8700d2b892bfb63af994ea110d12b46893287c59c34878124f70f5dca1286346166c3f157e67d3d5d65af90798d6cfb713a2de85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
022d94ec0b13ca8f548837aefabe680a

SHA1
275af00fc95e70d0aced4f2431bda7a2295dcdcb

SHA256
2a431639ed9f1c06fed57c608aafbdde4f409ad5a451bbfaa33b1845d50953d0

SHA512
bfa55e1357edb7c0d557508f72a68bced2a137e504669e89083b6859a187236b43a7840c7e4d723d1ed0f9f744e4939d694b81961e7d18ad08f58abb63f73839

Download Submit