hxxps://t1[.]a[.]editions-legislatives[.]fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=[//]t1[.]a[.]editions-legislatives[.]fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=[//]app-androidl[.]com/aouth/livelogon/SGZ1Yz8xBe7vw7f41wnEFVvRV7f/cnlhbi5oYWxsQG1leWVydG9vbC5jb20=&[.][.]=c&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=hxxp://www[.]lampsplus[.]com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo

Resubmissions

18/11/2024, 14:56

241118-sbaxbayeqe 7

18/11/2024, 14:55

241118-samvgszaln 7

18/11/2024, 14:49

241118-r7dseayhpj 7

18/11/2024, 14:45

241118-r42easyhkj 7

Analysis

max time kernel
608s
max time network
689s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//app-androidl.com/aouth/livelogon/SGZ1Yz8xBe7vw7f41wnEFVvRV7f/cnlhbi5oYWxsQG1leWVydG9vbC5jb20=&..=c&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
4688	msedge.exe
4688	msedge.exe
2572	identity_helper.exe
2572	identity_helper.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4612	4688	msedge.exe	83
PID 4688 wrote to memory of 4612	4688	msedge.exe	83
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 652	4688	msedge.exe	84
PID 4688 wrote to memory of 3736	4688	msedge.exe	85
PID 4688 wrote to memory of 3736	4688	msedge.exe	85
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86
PID 4688 wrote to memory of 3656	4688	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//app-androidl.com/aouth/livelogon/SGZ1Yz8xBe7vw7f41wnEFVvRV7f/cnlhbi5oYWxsQG1leWVydG9vbC5jb20=&..=c&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83d9846f8,0x7ff83d984708,0x7ff83d984718
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10263702708541679380,1224372415558184521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
50KB

MD5
f1621ce6e78b61317e66af946e42e663

SHA1
5ef074357249ac5768d11f83afa4d5d698c39c88

SHA256
7e56e0549f16ecc98df24a8e57a1a15a41406578b0a65f62e6408b4314ed9ab6

SHA512
5074d02c0c1e50c45807b88d17f5916890f784d706d3130045f4d1f303a7ad29cbd4f502b390440ccef1912e384363cf412489a064471c1b9b63185b2def22a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b4bfcdbca80cfd9_0

Filesize
289B

MD5
68aa9f462325a4c1909fab9b55f51c8c

SHA1
501b9c9ec3dd38de5048dc70bf915baf581fec73

SHA256
5b24c335c076b46810ba923de7ccbd0fac417987b708490ac149cade2051eb75

SHA512
a320506c6c17d183c6394d56145724978b43617e4f13a0a03a79342a5b5430d37d8a32e162d20c6678edb75c4fcfaa02d0a919d32780442274ae3f8d9bc8e16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a7f7807b6ecc52a9_0

Filesize
20KB

MD5
c9b6bdd92ed536f3b6c20df3759e4723

SHA1
2bf23f3d2e0cf92215f9c2a87b3eb325654af453

SHA256
43faa5809749267bde433effeb2d13f7442a3aea0084ca0e185926807ebd9d1d

SHA512
5c6d00384e078ca369324c0d91b67fbf76ba2683202a779ae6122a049fcdb7edff68b16988d3e89aa674ee9f1d62c558e40d54267dfc2551d27dba7cb6b9cc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e33de4f837ed31dc_0

Filesize
377KB

MD5
80cdaa64e2e50d424c8b4bcac7aeca22

SHA1
af6544cd081053374751d3fc77aad95f17523d33

SHA256
acf4fefa399f5d8ae0e737e8600527f5d24ee6ed0d6e16da2426369cd9578798

SHA512
d010ef0e38b4297fbf6ce64b8e089b4f8db37c82005d62f37a632b1b6cb94174f3dd05664854bbb225d0735840cdfa5a37349514e043cb3b230121d0feacad70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
36d2aad3432aae353e94c1f71d05ee19

SHA1
3511d224f489bc56e051c0ee95fc937fd753d1c5

SHA256
91ace8ea16c9f869498a4a03ef5914d4a35d8413cfdbf40c16e8b81c296a129a

SHA512
06fc69ec497abeb643d09b0457d16f394bd4d442bff43361b0a30aa604414bc670aba392370467007b9ab6095ca832631a197cd283ab4dba1830415d6a605d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
633b4f3f1367b82bd91e15b3ff811ded

SHA1
acffc82b90a077f065948da7ce1f1660c70c56ac

SHA256
904e9858ab5ca09b17ff6fbaddae838d6025c4b707e360a588b0ce9136abdd5b

SHA512
e365397523c53c6e8457be72862f83c2ec7440cc48cf468178ad2fcf33b4f48414a360a2e94e4ae7f5cc934106bf99b0342518789f85f1ba3ec0bf8a1430ab37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3ca136c3b985a9cebcd60f94aeffe1e2

SHA1
d94d14e3792e683fe475574a9652da024fd33618

SHA256
5b3c71c410be813398e8b33bf0842fda14bca01b09572e5c6386ebbf239f4859

SHA512
e39a22223d91828b0ef27c55e9f8f1d25cc679078109dbca8e2e182430ec9c975bf14928597bca2ced2b0f994b0a75e17b9e5ab030c1a357133d0cf298cacc81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
32484accf33ce9d51ec58f6ca353f50e

SHA1
3107eaf3a1f5a549c3728e13d21f64c8dfbcc74f

SHA256
7239502f6f67cea19224f9fc861ab4399c5849eb3198f6ccab07a56931d5b2eb

SHA512
4b1e4bb43abcc2bc3d8eb866cee6ad1b880340d8a79e331cf76038bbc8f64f3498fb2a72928b7c3e0958b7d8eff3660af3a5adc9186cb257c3d9562d77da7e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
26e8a1c880cecf2fd74569d8670485d0

SHA1
9ae257835f35e7294c376cb79c6c8b466ca0fda2

SHA256
4a7131af10343c42148daa1021f6bad28d9a9248da1f1bdf1f00c4422f30991d

SHA512
090b8c3b2f4bc40d98bc66058afe399f41f4407e20213e6d46235c126088c4038597dee63deba6386b31698f73034b16827f18ff1f226a31293fa5fdc689759c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b94e800c10b4fc4a0d2b67e6decb9209

SHA1
8cccf33c7b667c94536c7cee1df8fe947c633e8a

SHA256
c83156bc174c2e4a0eb6c9784020689d4f88734ec770bdcffff017e8b240e7f6

SHA512
ff6a7f38eaa693b076e193337c7312d57cbc5fb7930b11482f0b0b394a5e78bb9f309f1ee903baf2c1952acbebf2f79461c20d6dd85c4767c153ffa3b99e2c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e5b2ed45b9277e99a463871387f7e0ec

SHA1
3c56aabf9037f199eed7f59981c193a48c4ef3ac

SHA256
c0b9930681cd7cab1bebb621425d4b88b70b387f77ad0a9cae4bd9d868daad09

SHA512
769e8148645dae299a7475f78a8d7633356cb6d6cd7bc769836a9b0d735d4cbe05bf8d23a4ea609eb7f98b31e049e48ba53595377896d1d59b2134579248d233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
912B

MD5
e617935d7522d70b2113eb8f5330a7c1

SHA1
aed9fa75e79c5aa37a612f96b9bf33f4ad7b0e1f

SHA256
d6f59c724b26578443694e94286a134a4817d6d9c333f1733d80af2258fd8526

SHA512
1c7b3dbdd09ccb503918b3ee17c987d0cbee550f8a8192414f6e1fc6922c1b0e5b69204d3f56551f05d1164b5f3439c3298faae5ae6576dfdff26164a6df67ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1fc822b392b803b9dd2b98acb3c8d48f

SHA1
6f94545bd63e54de38d4dc41fb2e238725ba7bdb

SHA256
bf05e3704b25f057a6fabc589fab0cf1818e63f68e3a8fd0ff4a7595b344e702

SHA512
f520b9ad7192295d8d084af161a1cf1c057502fdc5d3c669107dc4067d4264328010f8ac408efbe2277dbdc53fbeb5820ec920d3d471bc66f3ec73e93205c531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
03ad99179dcb08d1cc23aabca1b72a0a

SHA1
76d9f8468e4bcda8b5ac06e194d159ee240abfbf

SHA256
1494c3eb797355ccf1b2e783ade88f2937909edc8a6ada2b86c40ba0794fb3d8

SHA512
0e3f6daf00ed5e3d3342ce45e086f6133677e11651c9eb1eae114c52cbde51043f0d042293fd2b768b90a07a930b8291200baf78a5def60e0ae5464abbe01bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
238fab0d26490e67e4b6d331873961c1

SHA1
a94b4de7bb0178cce2cc9e3784f14da4ae60f166

SHA256
025681ae928d832bb73ad0a4ae1a62ce12de0cae958b1e9ee618556af54fb459

SHA512
1074112a7994d64ee5be1ab5c9e9965376e452be5769012575b4bf6d6153b67ead69ebab9fc73e18a5ecf72b5bcd7972684dab9b7ce1a9aa1680d7bce4c07447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
615a1ef582ea7d96f9788dc761c57550

SHA1
f5b49761edda1d4ffeea2135da5d66ef55489f4f

SHA256
e7f8032404730d03f0c93a59d565c1d1d050b5453d3ee2443f73fee93ced33a6

SHA512
3c017e1821468da8566c399c9df7a41a1dcca7c459165f2a23fee4691adce157ef3b745913414daa343e31e910c1541af646fb4d229586d21a314068b41b3ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
57d30eaaad220cd874c0c5eab7f16c7e

SHA1
d7f7ef877ba9cc0ba0ceffc3ebbd90fcbc9393f7

SHA256
81dbfcb7e2dfe8a08effa73701b761a5d99e41ee3db10f5e7118475911f68714

SHA512
4a960fdf4989c0ed91bd4afea90b9d9ceaf8c12fdc1116c30b453e4b1b41ce85e08ea6a93d6180de2b221a6aa7ae78d1238918e5ad2b6ea70aeb94752d8638ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
acb602402ed12d61eb96fa396df11363

SHA1
93dd90e66085737b4022c874b75bc845c6567445

SHA256
d7b2d5f110e482fa9d20283edcf1c71429064578eb13abcc164dd845c086950d

SHA512
5cb3b4e2691cf1c64f2079efac8e185b3d2a04645c8664e9b65882e9c497a6716a131717f312f7833537d785fe3f616a487d3a7e516c4cd30ed8bc1c906696f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bc3e8dc22521ad50ddb50e9459837b49

SHA1
d7aabcf5aba803ed750d3a0319a241c562f74e6f

SHA256
ae006c03ec9207db2bd023b3c85102df6aa7317f5640789cfb2e010e57c35f00

SHA512
eec9089abb46bb7686a7ee9352466c3f05831c9f77b5fd5e8684997bbdcb947522decb4b6983d57f63979efc0d457fd8c9edc10567547b8998d6311dc5b57dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
42c90d1d33d3e0b945c2c8cce56e251e

SHA1
fecc9ed7b1f1aa01942b9b121bedb58a8d1c6ca6

SHA256
78ebd43a10ebb6ed4c379dc6f28da5f1a3209800e496712b0c466743d934355a

SHA512
ef23d3574da6e743e50aeb9cad13ed644993bfaa3db9cca69778499793cb3f4bcf01a41fb1d89a34a2ac803ee39a829c1fd5f994b7d54d24fa0f88170e218e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0b1011c038069b1fdc0da42a6813319

SHA1
0607f2cd2de0d565836e47a34d72b200ed23c1d5

SHA256
e423920dd39f5677ed1ee7ebd051444d4d3043314545380ad56e7a4e30350872

SHA512
fad4bf48b039200983bf9723f17c13d56e6cd9642040a403f9a55489e5ebc18dd736a4273332de3273714d9048e523dd5847bed1e89f09c11f3d101c76a7508e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ead06417f74a935767e672d0e39eb00f

SHA1
0eab89ee6e823f9d51f20d177b0f9914f76f28d3

SHA256
82ff3f8118aa26a2a2d3fc60f298e259278556aaa2ccb0449ca5af5e93dddd35

SHA512
6aafdcc1c1ec00861555e1da81183754372ff16cbd70c59a799ec01ad2cc561debc6f147a958b346e4508cdad1e10ea974d6e1705aaaf4b8f62447f4ee968e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
8eb6863c2e59e3771bfc22f594ad703a

SHA1
21d9935a688cca60bb3186cae536440c6c9433d1

SHA256
95f6ec5aee48754d0bd23e435b0459f3bfbbc62e11c4b4cc2df9245d9bc3e887

SHA512
bed5e548e17f7251b9487c254eded215ccd6222e4e79ea51b532b377a39d0eb51e59281f9e2217940228d21f42d512a6b054c6ef43f7f767e2b5619d433c1da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c421cc374349475145c72f2987f2e1e2

SHA1
4ca226a6935fd4dc18ff6cf854291026cd213972

SHA256
1ac2b660f36f7d8f8858be1f8664e71c339b6c8795f0c4c59a1b08474234d5b9

SHA512
0b71235b9f98e1638b83df73b519d4bf7eece419d66f7c2f9fc0fde083cbc61454e219212175b2552fc9c54a1310a7dfe86c7e328ec8814acc461530e0a0d6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
972e5218a9ba7caffdb4b6549beaf254

SHA1
ce297f632e7399af417464a022d4acba9ca5678a

SHA256
6ae8ba9ad2aa3fa918609cbfb11f818951fcfb7a4be3ced433150efdc97cf0f2

SHA512
7b66d4e06efaac28a75bc447762badc56cf9826930cdfce793ca33e35dcd6b57b3d6404956db5842ef0f25ae44cdc23f27a3903a6a9ecb557b1de12c6796b58b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
258b02af4d2da8145ecc77d23e3551b1

SHA1
6808641988865befd81492ac56a9b81bb8ea1224

SHA256
2795e7159ab3da3273709dbb85e76ee548b9054047c7dc8ec429bc6634ae01f5

SHA512
a24124c8441007dd150919552ec36b95abda813c8927a05aa23f9e3f11978472412512bc9f6dfa9f4e147482a466baef4d3cedb6993953879b2eb0812be367fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
9b44711028da2e7b142f1848c557c675

SHA1
dcc0d158cb323cf7471450a6473949653c3157a2

SHA256
c09f597a59d82ab3fe48ee14d75ef2c8485177d61297541b7aa092c36e89ed38

SHA512
971b5373a0f8b26f3e4e5970251bafffc94a5df6da8ca57ced6306279eb08c0a803ac06d2ea254f0fce2c60fef8af8cde75baf928bfc62b10e6ff39b33639a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
dd8ffcc4c96327b158738c4d3fa6ef1b

SHA1
3797f2bbc965da3caf8fea7bef1492dbd76968c8

SHA256
16e61560fe194c60bb3a4ae4130f5afcec68680296c51f56753cd9236cc7b481

SHA512
8f3ded0517b8a1b7cd5ba32b6c93b0c33249337f297eaa4687883d22a84ebccb14b860d2cca3a8123d7afe5978cbafbfdb81881208bd4ffb1a717a3ca48da499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
36d2a81581270716154187cecc6dca6b

SHA1
e053f7e8dba566896c545c2da7f8141a8872cfcc

SHA256
15baa4e556621ae75a229056e425c9d2eb5842883df00c1d2847cc4b611b523e

SHA512
019900c99105ec00e8f90fba7d4ba2871fdbc1385a5a5acd3ae31d05559e0cb4dd764f7335c7a55920df0f651db86fb9e636cd0466282e51a433adbfed35c528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f027.TMP

Filesize
204B

MD5
bc8f5a7c5c28c0e645c6c2c5ee03757f

SHA1
faf0edbff6cf6d0ddeb3af6ab3226e330087d00a

SHA256
b53370e40d840b7c12af3339c8a90188a047326184108b4295c8fc912bc53f0a

SHA512
99ff7039c70fa589858e580b2d457e8e8dc6c17c41fd156cbea8cfa8e0bb857e4a653dcb4dbb44bacb60d7f8112d069e80493e3adfeba23f12689fa8c39921d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
562f092cb4c97b799c86ec7ca5c4408b

SHA1
ecfdbb864090972ba382515552ae8404d9a1b20f

SHA256
76392f035e998ae20ac2c63b97024d910c76235df3041c121115972e0544b15b

SHA512
21cc4f94b95285197eccd0fa50aa0f63b7f80a4028de7646913e626557a879db602d6e52832dca653a669a99329f8d0ec7cda5921bf98520d61fedaf8b57cd9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit