27410bc7be14c47eb58679632c4f683dcd90814191ad030fd254e4ff96646523

Resubmissions

23-11-2024 01:08

241123-bhmq1stnht 9

23-11-2024 01:05

241123-bfwadatnes 5

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-11-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inbox.png
Size

380KB
MD5

ac6b3da921d65420f87bfe834a0af4af
SHA1

e626e96e876c3efca77c5d20d45d2688343f4e1c
SHA256

27410bc7be14c47eb58679632c4f683dcd90814191ad030fd254e4ff96646523
SHA512

1ffac797295123cfa93ff22677eeaaea9994dc07b0070c5b3012c96a918a60230190fd2419b780073a5a312065d9af1ed573ce10c27bb3abd61c7925425e37db
SSDEEP

6144:Jxfkm9zdfezpYigNE5pk7znts/imEDWUuENSdn9qoA12/oMs5WqKZV5bbDjTQBRb:JxfrJ9e+TGk7zZi4NqUBAFD53/8BRiBu

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-556537508-2730415644-482548075-1000\{B486FE98-6E89-4807-9567-84205A88AA63}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
1228	msedge.exe
1228	msedge.exe
716	msedge.exe
716	msedge.exe
3080	identity_helper.exe
3080	identity_helper.exe
4840	msedge.exe
3204	msedge.exe
3204	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 3356	1228	msedge.exe	81
PID 1228 wrote to memory of 3356	1228	msedge.exe	81
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 2840	1228	msedge.exe	82
PID 1228 wrote to memory of 3052	1228	msedge.exe	83
PID 1228 wrote to memory of 3052	1228	msedge.exe	83
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84
PID 1228 wrote to memory of 1100	1228	msedge.exe	84

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\inbox.png
1⤵
PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca7483cb8,0x7ffca7483cc8,0x7ffca7483cd8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16801338273241066446,5171696067008537335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cafc94d67d8ef1514d0aa44ac66a025a

SHA1
24d43e3f9eddcb8c35233efb078ccb52b5594f07

SHA256
a0648a49161cecf70fdac70087986ec159301fccf7b9290a167d7ac144727fc3

SHA512
8975a22a104ce4408daad8801cd36447c7e052d8c3ef43401c2df3eaf0ca2af1c04d6efac40d77bbee784409209c89e836b8aa698947511adf32ac16fb96f596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ae7e2252c1cbdc002136b3fd4b82c50f

SHA1
9fd1d1a30f8c1f80723d9e4f4ba9b774fccaa12b

SHA256
7afd6ecfb615f529dff7fbe0432788622dee4259e7ac88d63f37f96afd520f71

SHA512
8b43026ef796dc59ceb864e2f8137de3d8a1685129c48db64b9ca7bd76812b68b9eac051723949d6d3b9e03a4466bd195569c97fe6592d2da1fe9bea7bbfad9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
177e0c5fee16ae8f6b6bf85ccdf82646

SHA1
47581d7a282a4ed98b9b9ff5988e348a03673b4e

SHA256
eac454f781eb356f05edbf0d847779f7e2e074cd8891a70ac1592fe1c2b47340

SHA512
83a6911f846fe0bfda37794e234c7f12bc51dd787289864f0f9260ea18375eac53bd9190255229ddeffa37ab6603a82201e7aff57ae243155711d0bf9c59f1eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
949ad705a1fb305b339d77f7a880ba52

SHA1
76391473dae6758ceff7b338f1ad5ced3ca6e34c

SHA256
0a17ba49716f1878a4ae3cf466c6e87a48a6c05a92b6cb0cdfb5cb575b25bbe9

SHA512
47ff9f634c8083bb903f91f9e1ec8bdbe9b70c39a1475980252500e5efbff303387aaad3abad0b9b0214de1bee2e348ad84d558c889dc533ca74173385a63082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fea0051f1cb84958c286c1fb80e989ff

SHA1
19f3507232705eb40307c69335b9595faa0c264f

SHA256
03a1fa9f664f04ba8a77de487e440f750e3669f0d28fc6421a59e3bac06e0882

SHA512
05d6dbd67fad4bff40f26bceb3485c496ccfc8f9433ff5c860bdf9d0f2bf112f0c4fb88c8a593cf064391ce7ab252358cb33c5321d4f674e8a2a876b300c045d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec28cc5ec4f283931fa496f175912dac

SHA1
05d660e95d025f57700318af2f8eb0fd62b3398e

SHA256
5bed0333feac9ad5eb13749c657b11f43af6c16d1e5e121bf16fd1fa0ac0e22d

SHA512
4923390ad1713d1ac5be3a5d92c3e88ef488913121a0a78b39dc496b1535a6109bad7a2ece43b41b9864024226d0f03d35f21164a235c42171e508b4ff96068d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9ea7c18b5b76f1bc080296a6dc417a71

SHA1
c2db342b9eadc7bd5634f0d86e9f645eb7c87a42

SHA256
aabd8b70c027e5c5838fd3ad89b33b24d05a1accda4e4f6711a446397669f969

SHA512
ee4fb72dc8b4dcd111f4e77b7fc478ccb0b6405ce4e357fd7ed7bd66037e19cdac77e49e683cf71b4c8fb5b06e38e4e1dc76294e7f41cfb6516359153c3ab504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
321e68f89acb37bea9ddac9db8f7dfea

SHA1
38d8b1000d49d13475c6a9a45ac49b3b42fdfb56

SHA256
332f7fdca0ea6150239abbc1fbdc7d0c80ffcbecda460aec724f624ca65d47b9

SHA512
0bd396d2213e2280281d0254558ba2c83051ddf92aa22749048664163ec5fa87c47599933ea09969aa48188441f37a05c82690e50a8766628ce5aa131d0e48d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d651f4597c251cb0c4e2c08e700d7fbf

SHA1
9708d1a25a55a28bc407d8596001b25beef686b4

SHA256
74e7cc9f45dcaa14bc7502700f00a3e46a26146b083d9b90c3105e994e20c251

SHA512
39948afb911dad273bc1451f13fb8f8d025e8a0f390855c9aae8e70ca55d0828f775337fd3285f0e7a111feb7cd75ad396bd00de89e253240a573a5cbe62b41b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
18e2355048da4a21c409ca895e5338a3

SHA1
1b5c96c7ba6ab1d344594a020d5f7fed811e6515

SHA256
8562ce7e5bd094cdcaf056286d4541945b69bad67e7bb954c6e7ddbc177ef2e6

SHA512
72f849daa8ecd0ed2c7faafd7bbc24d0e2deae87de1baf691e1f8cfc1c55ef51e553f890b211fc714457b60695f5b533f66fa250c44da71b36a4d1b154a9a481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cfd8a47ee7806fe5ba172d8bc54df0e2

SHA1
3f56f97870f4fcfb01d9f8ca9737a4fe08664b96

SHA256
453bd9d9c1eb3ae4977ef5a3e623ca66d7e5cad7cde81005e6558c16ea981e17

SHA512
77ae80854a13b1a0de5eecbf0e0531475cc77268785da4bee5116172899d20c64355fef567fe793820332f9a4c76a42ae87c2b5c5f8083ec6e8425376e711833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
adfadb08a5e609ef3587ead7766d54bd

SHA1
26f7b0bf32abdc4ed4d52c923a6696f06092a0e8

SHA256
084c57e65077f5ecab3d80707d41ee3c88a283fd0f7b65e016c41b31a13ace6f

SHA512
5cecaec7f14097152d8d6851d668a0e9caf9317bd7e1b8978fa8ac623624f2b4cd30758ba966b2126a37387980529c38721a8a4bd23074f1a77d5415667ca498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6cd069ee5189424f554c6920e5f71de5

SHA1
5fb0f763498a15bbdbe53d1319407886f92cabf3

SHA256
338a071c532861b3e5e82ebd939f834c41faed2461c0ee75046e380215b59b2c

SHA512
9e333ed865c3d6e6e4a63320547a5fee05c7274720d82b2f73747af6421ac2b5c7d56d8e125e57d77b2225ccf873fd29c0e2031fec22fbb55639f085686f95e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
285e984a653b9e9f2fe68b0a869ed5f8

SHA1
bc9e537cfd2085392da6af526eae38524c21046f

SHA256
98be281d68dce5e7f4597c761331175c5146373b5fd7028c98dc94b9e561fa52

SHA512
51aa2f24146426f8940d52e39230192b366ab520fb362c1fbf0995636dbaa3e9713f9ccc314bbbd64efa73b6492a6deda791da872bc555448d85febb45d3625d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
696c84c847519071966036cccc7b4fab

SHA1
0d341a4ac79c22d1060b1e28e9606934fcbb544b

SHA256
ebac75ec3338217ccfa53b821e3fcbbcea4e2a737b06191c59b5cae53ab43cd4

SHA512
49c85b2c8821b8eb2ceb777909103176f5f5fa419860ab190be77c6308ac7b1e02a7f0959e4e29db26482ab2a2cfa6f1a43354875257f48e7fffa71cfd8548d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c23526cc481e411a8620a27f6ec57568

SHA1
4ee19b5994008ac21f6d778451b3801941fcd7c8

SHA256
fd4045ed225c5d4ae2fbffc5c8a2bc3d550d6d19e326cad9a175228581b96b5f

SHA512
209a66e6ae23384977eb5beee797e2d8ad151a35155177c0b164ca1948ccf52aec400aa9e14b7509df0856b1a35ffa0865ef6a041b6eca333012404de5049364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb7cc0a734312c88fdd782453c7c08eb

SHA1
d672d6fa3861d4a8e0815b19611efca65cede2c0

SHA256
0d91296075df5a0aa91046113389243a11bc1c99b846fbcdcf10e8d4a2f95fb5

SHA512
e1e4e07f3a0c3e783d3203d36d7554e1db290b8433dbdfae418817812788e807dd45625f719f771f1c67111965e3f38889f78461ed9df9183e65da447b006e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
b15403f0a5941cf72309a6b611be4bcb

SHA1
f9537eea16c5ab88476b6bbef15bc9a7f0b05154

SHA256
b51f886aa6b728c4b3b1d6d9f1057939483e0695209f1b65374e61b0c3526215

SHA512
f7f5f5d75357366957ec6abbcb828f0b786f1d66dddb537bfc319f737375cf25f3edb7dbfdab78700ae8903d625c455345cae95cbfdcb1ae3c46189a75440a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ef25581a958f93815101b701ee76745d

SHA1
1f387b292e6d460769bfefe85cbd3196f78486e8

SHA256
490785a9f686b3882b1ed1b3dc3fa0d1d1c864f760f8484f994644c5dd47b22b

SHA512
fd896ea1590c0e4f1305883e503a553d898052a4a3d79d1d43c8827bd4ef7316c8cfa8858a38da6cc87ff112c88882a701b0ddcaacfb0634e2e13f2dab34c662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5812b8.TMP

Filesize
537B

MD5
a49b77d160ef393a820d89593a751ba8

SHA1
9c023a18f37329e625a7d4fc403cea8e7c6ff1db

SHA256
17c057c43a9bccb03783a46757aac3a4e1a9fa836c6d5f0ac91c204214ddb40b

SHA512
1889a8b8e09f3e45b9a1eb45cf6868772901b7552f568d5d44fefd1f36ffe0e055b0e4e4bfe944f92a165fb86368a80c899586cefb45398ff2896ae7c93a2dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ed8d93c1e5792761f092989334ac6002

SHA1
dbe8ac0a8a74fbbeb4bbf3a594b471b2730fb508

SHA256
143e0f3df837a620ca043f58b40d59b14634f7a8ece5526e93f6e4e1ecf95f37

SHA512
161c1adc84653794dcbb3d2e73bccce1b20e27efbb49f93c3f782c2ab9e01e290d20cd54fdeed95e70e51064e1bb81f87254e33b19ab32de5566992426aaf018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
158f886302dee105782282b226d42786

SHA1
2d62cb82bd6235fd5d625949492ea7120168cf72

SHA256
332ed64fb92c7549576f1066d87d3158e576c0501d060e675d0bd8a8f29496ea

SHA512
6deab21c4852417a01e695485bc60a3fed2df1b50196c03339ccc358c421b8c75f406ae91ecea17ef6d694e214d902f81194efbcfd3e9f3a66d131e8765bec24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit