hxxps://jolamar-my[.]sharepoint[.]com/[:]f[:]/p/jill/Eritfuq3V05IkfCu9NaKlMQBwsWpnFL0ntDiLN4HJgb5Ww?e=TmcuAQ__;!!P5FZM7ryyeY!XnLv9liFBA_uTs0c8LvdhZZJWfuW0qGo1u-DvQmun0HQdaT0Td_j3dvbe4VfcG0QWlSHtpClrmJ1pgul6w$

Resubmissions

05/12/2024, 04:09

241205-eqwwfayjbt 7

05/12/2024, 04:05

241205-enxpystpcn 7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://jolamar-my.sharepoint.com/:f:/p/jill/Eritfuq3V05IkfCu9NaKlMQBwsWpnFL0ntDiLN4HJgb5Ww?e=TmcuAQ__;!!P5FZM7ryyeY!XnLv9liFBA_uTs0c8LvdhZZJWfuW0qGo1u-DvQmun0HQdaT0Td_j3dvbe4VfcG0QWlSHtpClrmJ1pgul6w$

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: GetListUsingPathDecodedUrl@a1
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
4440	msedge.exe
4440	msedge.exe
2332	identity_helper.exe
2332	identity_helper.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 2100	4440	msedge.exe	84
PID 4440 wrote to memory of 2100	4440	msedge.exe	84
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 4396	4440	msedge.exe	85
PID 4440 wrote to memory of 2768	4440	msedge.exe	86
PID 4440 wrote to memory of 2768	4440	msedge.exe	86
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87
PID 4440 wrote to memory of 864	4440	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://jolamar-my.sharepoint.com/:f:/p/jill/Eritfuq3V05IkfCu9NaKlMQBwsWpnFL0ntDiLN4HJgb5Ww?e=TmcuAQ__;!!P5FZM7ryyeY!XnLv9liFBA_uTs0c8LvdhZZJWfuW0qGo1u-DvQmun0HQdaT0Td_j3dvbe4VfcG0QWlSHtpClrmJ1pgul6w$
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefb2f46f8,0x7ffefb2f4708,0x7ffefb2f4718
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
38KB

MD5
e48061b164573549914439e190948500

SHA1
6ba0bcd37274504578503d87274659fbd4b47216

SHA256
eb7da0478ce4d9f3ea966d7fe81e057cdbd2ff0fd3bd9e80e410851ab947f5e9

SHA512
1d5b3b5980d8bfc31373fb5656f9d744fc60510efd637e14b8c4f63e6973fda67de2c4a33b832be54a29102dfc4e3304d4bce914d3100dccdae8358334dcd1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b8

Filesize
21KB

MD5
3121eb7b90aafbd79004290988d25744

SHA1
5584f1beb7b9e8ca11833035c9962b3ddd54f904

SHA256
6dbe807b8da91d549a49beec3330d795601ec0f272ea232e91121f3ed703dfe4

SHA512
ed25bf0b7c12742a7b71bc271364970508fb03a5096f42eedc360ce92205af5be0ac4eb0567585882d34629d179f9cab287839247c81f61d894360a83b28aaa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ba

Filesize
25KB

MD5
b2b60f1c7184b15ebd6cb2a213c323c5

SHA1
8fed557ff6e49376f3a4bc56f95a548d6075955d

SHA256
dba7c93d3cf4806133d8fe211dce32aa12041fb82acc4591f464052714878fb8

SHA512
e1a4bb4afa8fa8c09e163ba9c0d264425378c8d50f212e2932a2b21cbb6983b566180657bb753681b960d02ca4dee73a5504d433c536e64da979cdf34aabb8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000bb

Filesize
35KB

MD5
a729d45a65e2b9849159e08ef6fd5f12

SHA1
75a14f3e8ac5d4eca6ade8771c84f4f5328301d6

SHA256
11980ecd03e02439a6300eeff5dbf9a48bd52eebf14bbcc246752b0ce5baf223

SHA512
89460bcacbedba68cd7fe67e675c5dfd76e6c43d87ed13d03eebf4a66bc298c85f96605306eb879d4ed89bfe0e53699a11a09bba866226f767ab97203395a6b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000bc

Filesize
35KB

MD5
e243d03bb4bdfb80fc2b9c40863299c5

SHA1
7abeba96529b293239da5536d4260efa1e797ad9

SHA256
a8283e1b2cabd16be04a6cb0a292e532d5b74520123e09c2cd9deb9eccf2d1eb

SHA512
7bda56879f1873647edf1b3d18e468430fa9a03ac88e8ac5209e834de13b7c0fd195f684f7afde8e526b4993c1debcdf6373357b925b423afcc37d76ee5c0f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3831164d5d66851260e266d5e3382c1e

SHA1
34e93e0b6532eb0e9db8ae3d619743d1110351df

SHA256
ace73d9feca3107b43696d45496eb5e1a8af3ee7a2f05e4f14b61735b4ec2f39

SHA512
883e02098d4397650189f15672f0ae0b542668bc12f65e77c678464177e817c444ddb75fcb6516ef948108312d1f7b5b58c91385da9e1083038ea2931c7847d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0b22fdac46d3aebb78c149907f62e131

SHA1
9dce4539e3612fa0a0a35a9f544b40f7d8cc33ed

SHA256
bb321eb5ca333ff92b443839d60e45fefe585df72f11f9c879212059548c5b5c

SHA512
8d44133b9843c057c13c5248c870c04a2d981a9b330124d14a0b7cd364d39fc7663e18f12886767dbc49301fbe79662834f89f265cb7c4ded8ec4dc6e7dc9388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8d7e81a0bc8f6e9b471a9a5c35716131

SHA1
1aa82eb6976b8fef156b218598ee10bf2438c4c9

SHA256
e86983a37284c68d8a3207747c5b2f320a760424295452a6a102bdd2ed6b56d1

SHA512
3f991316add5af88bd3b5e0848720d935dba90ddbb07924c9c306c478765d31b9ebf8237821c0d8b195f5a9e5991cb7c11009bab7189d695214ee0235e4fc89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
51f7887327b8c7ea80824d5fe112b25d

SHA1
d414e9c915416e04012e6f707b6f15fb7503e9ef

SHA256
51dd1a38f4b97d6148e961809e084059f33e5de5db426bcabe5bd777df740c86

SHA512
63e8cae8abb9cfd8099e315ad7360fa6e490d06268983b2a18db3891de822a7e52b2baac0b57758c5f9dd1e71d5fed175a38ec9d74302947e40032574284c5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6c1d07633e0d18d988643f3fc47557f8

SHA1
e2a0e3bb3937aa291c9acb07cf24357684af5a04

SHA256
78babf96a0f3d4eb4a30e7ac2ba7039955236e1d968616b63c8a858905a68c3d

SHA512
971a49fd63efd298774b3d05cfd1d88b9e9ea3844ec1e0de7cb9dede88ffe1bf625946b37b10ee9691be5f393fdf8e811e9ee68f5fbd76cdcdb21d925212d59f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a32f3d090c161645c100837d0f7e821c

SHA1
8b3fd4dadf9ccd4f85a8df6bf9496ddf6e0da626

SHA256
5a0e42248c5b84b176d828bdad5a5cf3d5587edaa20c402509f9e4afccb69ed7

SHA512
d9ac5421ba7d9957761e8881e59997a3ef11577da6d98b9784e67a1cdca657b662a7ce7df20d61f302173c5fceed8e084df59284c0d213e8f272bc34e1a7a322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e3002cccc19697471d729296292ba518

SHA1
5747882fd3c37404323aa709b17bba779933bde1

SHA256
9739e8a70e881a885bda7caa03d1c6cbbf6868802dbaa8d6c78d6c3815bb65be

SHA512
a4afa4b397e6bab0dfd18ef5c365d67ac110a28ac2b9f7ee2abc27e0766e864c95ae9b40765704c924dd1fb31e6377076a5e634a732275a34ce3b87bac8dcce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec4263c052556e67435ba400d15e7876

SHA1
f25455bddfc172404cd473b518ab96a601d72f0d

SHA256
815751fe0e5fc2d5a2168b31b4b7621cd89e9fc2e0a38ba114c1e44e9c92739a

SHA512
c8bd4f26c92f58d1fcbecdcd8fc2c267eece25c6490e8937e0684acae870f1c89756c2de29e16d9c39cbe3cfd6ba48486befeded3067fde918db995d678b690d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
24a7bc6932de3327a06837ab743f0fe4

SHA1
eeb672c5b53c85824cd8c00f378d615e5b688fa9

SHA256
ad07f1309379ee9e706ac323958df7ac63665e7d47d1a1273093bbe1c82e3ac4

SHA512
df1763837e5e241528b6e7b92522f508b4470e0ad88e43aea62c0cc0d41155f39111c571a75b335c47df80ffbc4f6481555479e7534422412f3b8050444954d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f99198fdd9b423481289f23d407e9064

SHA1
847c3aaefaaeafa349618c25335c0b525b4f1e13

SHA256
f37836a8aad7f5412ea43dca9de0488e401b5fac83d4e08306cb52379ad56865

SHA512
671fe82d8df5beb6ed405a32b8e6870af6b22d1cb866f1b30ba573bba09029fc7622d6fafb200e250b34745077d9b9dca1376e73bb6f474513e6fe3f08cb3241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\908c426e-f537-4333-a977-a3e88c3b0f94\index-dir\the-real-index

Filesize
768B

MD5
1c5933a0c573b2b3e5bd903b0a467f8a

SHA1
9c63523418819864d13254539c5a30106564e046

SHA256
0963e34daaf057bfb693cd78c65ab9390c8c32488898c378001da9eeab71d56d

SHA512
ab6820bb3fc5e50fa65d43e5be51eb59e65e4b674ec805374c07211e449aacb2f77eead932b38a57490d23fc85a9baea484705414341242dffc1c356033994d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\908c426e-f537-4333-a977-a3e88c3b0f94\index-dir\the-real-index~RFe588d85.TMP

Filesize
48B

MD5
c23713ab91ac59a5f5afb1beef416de5

SHA1
6adaf7894b7ee817a3b640cf47ae84086529f739

SHA256
2582eb457d689196cd4169206ae1d92f996bcc1dd6684b10b2600dfe43ba0d95

SHA512
bfff23f687c5a155dea588076de917b6e54e42ec1a4dd9934a96d31c5eca7e791b3a1cb7edccc3d1b6b655458f210a163c03943284dfd9a7a1a713bfdef0cb78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\c70c6323-198c-47c0-a305-0db49a786f1e\index-dir\the-real-index

Filesize
21KB

MD5
f55261e459a369abe2f8aa647e1cd170

SHA1
1663e425368554b58bf7c67fea6fd4097a327d7d

SHA256
7c2a75618f51e6889a722adbe57e516d02f51c589520bda8ad1b193017caa708

SHA512
2341155c0a9bf9075e86902eddb770a0c03a67d9110cc98fcbbbcef1c2f5eb4403836f08f8fc866e760a6c05b68dcb1e66df92925b5737a342047aee2186e83a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\c70c6323-198c-47c0-a305-0db49a786f1e\index-dir\the-real-index~RFe588b53.TMP

Filesize
48B

MD5
f064f7e31c5c9b58be1cd4c439f0e737

SHA1
b15977cd4ac9ca149d8f0674cc40edb92e40eb11

SHA256
8975e2acee1ea4edb06f598a452911a3faba584913e80261212d8b2ee329ab36

SHA512
e3978d07d71485a9b96d738e713dc5f4cf35e4666dd241b8a81f7e8c83930761fbfa4c1507fdef1a15c49ae1628caea7cac149408d88372c2aed50ac690afeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\index.txt

Filesize
177B

MD5
2e4080838f8da18c089aa4b402262121

SHA1
16efbeb1e4c5f49a6eb4de7d9212c45b480abfd7

SHA256
487f3f4ff98c2b2197ac207813e21d487760994c897d4d01edb41c1416ef175e

SHA512
3b6fc5ea014ee06ba6eaecda33a87bfaa246b09dfdd2c69da46370a30dd6b367bc5cda923bb3a9b807c0edc09b9309c287df4e22c9cc964883726775de5323bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\index.txt

Filesize
173B

MD5
830bde58119f35c79f75ed765da30244

SHA1
97e761180b67890bb6bed7b8c38cb5f6c67e042a

SHA256
62c65f54b49fc41a955161fa4624ed7bb820e6ed03477c174ccbf51d4a90d9b4

SHA512
22f6d5ec79afb4f8717998fa787674ba6799263f01a05121047e60e07aa637a167608c28b405b0062054282f93494cb97726f7b8c1e0906eb72ffcc0249a8376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\index.txt~RFe5836f9.TMP

Filesize
106B

MD5
6649aa59ff65226c473f903d1da61104

SHA1
df89b050eee088a472874a2cf27696367a97c036

SHA256
991b6056eaa04c5fc247612a487f4bcea9d27dd785535aeeb18dd9787c2813ea

SHA512
5e9f5ce4c34a2ad904a0c48c32c2d62f9543c656a68c37ea0477074a4aab076a5a177498d9b08619744b6a0499eb4c12b282afd9a590edd6d3b67471b29274bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
9965d927cd6595b453331a5353d47867

SHA1
72028301a7f29e2760bbf7b69bd85de699d92a8c

SHA256
e170f3321713d67204977f9c26ba7d48df8bc348014fe857a01486b3c18897c4

SHA512
ae012b6bd64391edaf26b6bd29e0abe3217b47b920964c817b631879ddd3b6dba20df9234e018d47ace78358e26544b1f91e8eb47a22d6483d9515ccda727a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5814cb.TMP

Filesize
48B

MD5
d3883669025e3ad2c74786a8a12651ae

SHA1
e55c8c1b16366b00efbd41135cdb7f5403a59509

SHA256
1f759495cea9bf6132214b99ac0a6d21c28c88fa8ad1022d34c534e4137b3019

SHA512
af796d58d94e4a03380023842b618304f3ed845ae5a70a888f6da3cb6720f628a97ad186d51fdf3a210ea1c5b1dd6403882d0f0616c794f60744c330e04cd1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
05c5b849cad4e2eba3cd948a5cbc94d8

SHA1
d1747e9df0e7fce031ba0dc63793a34a1a69c63e

SHA256
6fffbabf2274cb0e0d63062c9f911e9bf9bebbd50d55e684478f56bbe77b0416

SHA512
fd08f8419d1d52c7447bf67e9e1b02d01f7c847542cbdda3ca3dde54060db2eff7dbd55d8ff3517767551a6dc05e2d98f69bbb70ab591a0a51810be27dcdbeba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cd8e8bb47702f2231162ccb6cdb21436

SHA1
855006f95130398f5bfa4bfa3f0cba05ca23698a

SHA256
d64673153cf50cdbdc2dba86a3e7e03cfa8c25706cac7d3cccb0cb998886dcde

SHA512
8751e17df557d19eba8d69e123ab5daf355e4b87d947216879272c6331ee15acc2bff26291ca34570561b9f446b05704d11d6e1fc9231d4fa4f453f5ce34a6d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0db5b4a0463e8624b0923441321300d1

SHA1
1119cacbf754ad19b2a0477f25c558bdd2292415

SHA256
05da78315347c52c92ac0fa35fabae4f6b19373661344c993814560f0e2be1b0

SHA512
9130ed7ab105e47059751ca7c77b70b79903c4a785e63619b0aaba0fe4974cdfc8efd4b8a38a72e013c631fb3fb7a377ff2bfcf1bf9d8a7c85e52c5e8fbdf6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f71e87dd4c1b0be81da08337ee875a53

SHA1
01b48f0ae916e8decb45ddeef095d68b0bc30c53

SHA256
e23334e0b9044eff99bce1313190abb68b6ee31f2d9686a4cd43b7016d663082

SHA512
ddea4701980c7e52f198a3020da0379c00a5d0d349c752997ef4bc19cee7607f9c7ddeb4d74ac0bbeb693cab2b805c3c62b5ab2b00e03ccd0626eea564cb7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
77dbb0f9f63d113cd695d88b9868f86e

SHA1
28ef991458b7296642242bfebee7d87269939bf4

SHA256
aa34d73edcc02c77d7ec0927a7e4482247ecc6733948d1a7b63e95e6356b5c8c

SHA512
5a1c560e220d33ecc54ccd84ae6ff94f6a536b4b40aad37e1f5baad4555fcff580b6531e1354e597675ee5663616bd60831751306ce471df8a7ad319f61248d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
260cd66010ba04917537a1706faa7f5e

SHA1
84af25e61a262d394ce951009a3ae3eec9ef2f7d

SHA256
53e1f9baccea6450ba1144b4f966859c44b55e74125fdb692504d7d1cb253bff

SHA512
599b39532d9c0cfa17cd7c87c9e1a929ec743efb2ae01b5e27767aaa7282d650649dfc899ae6b32b6f385e102aeabc785398756641a50ffe53c8ea02016a697f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580635.TMP

Filesize
1KB

MD5
5d5d98dc41604bfc3ed5eee70d3cc4c4

SHA1
2cbb6e78c9a823ddc0143bcd285dca0a63c4968a

SHA256
8d54c0d223a30ace6c798f1550c948def823987a4209a406647a4cca95be4d0a

SHA512
635bc323cfa521d69b247f9f1fbc844f30bd16062b99b0166f8b7126539037ccb45bd96a611eaed4c3f48fd5249fe7057ea71260bc9534c97c7153b0569d0c12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
91d21433cd7ef6e47d9841459bfe96fc

SHA1
b3d89247b9406099879ee3d9006ddff1c6e8ce11

SHA256
50152d48b17338cc678cb772ce49120326e991e13da69735935a3fc359c5f8ae

SHA512
ed5e2580acff7045989f561aab7603b63f19394a7ebb9da0ab146a8a53c8077b66b94010dc5e8bc7627b786bdc4bc9d12f69d253b2b608f437f83b3cc56f5bec

Download Submit