6d5b854ecbc462c71094568fda7c8825e6b3d3fb6dac1df8c5812d8381de7c16

Resubmissions

13-12-2024 16:51

241213-vc4xwsvlb1 4

13-12-2024 16:50

241213-vb8vfswnhm 7

13-12-2024 16:48

241213-va6cyavkgt 7

Analysis

max time kernel
206s
max time network
208s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13-12-2024 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

267KB
MD5

013e0b981d54f5a9de5a6cf632d01861
SHA1

318906e3b9d2ee91e8f2f5c77fc71a0dea6b1730
SHA256

6d5b854ecbc462c71094568fda7c8825e6b3d3fb6dac1df8c5812d8381de7c16
SHA512

139867456d28bb98457e90c29f5c1c669e2a827fef771a51490fd6214c8f0e99988406aeebbbbd744f7422cc78e6c1fff10ac4ddd5a7f6a7ff796b176bc2b3d8
SSDEEP

3072:IfixOi+0joZHnIbOGlyJzh4BgEJwPBIsgUAwtN+Tl/jah:IfixA0joZHIbYJmgEJAIBNah

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "200"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdoma = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\signup.live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com\ = "40"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdo = "2"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\signup.live.com\ = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com\ = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "2"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdo = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "124"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\signup.live.com\ = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\signup.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\Total = "40"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdo = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com\ = "0"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\NumberOfSu = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\signup.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\login.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	wwahost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
1160	msedge.exe
1160	msedge.exe
1368	msedge.exe
1368	msedge.exe
5052	msedge.exe
5052	msedge.exe
1104	identity_helper.exe
1104	identity_helper.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	wwahost.exe
Token: SeDebugPrivilege	1136	wwahost.exe
Token: SeDebugPrivilege	1136	wwahost.exe
Token: SeShutdownPrivilege	3144	LogonUI.exe
Token: SeCreatePagefilePrivilege	3144	LogonUI.exe
Token: SeShutdownPrivilege	3144	LogonUI.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5040	MiniSearchHost.exe
1136	wwahost.exe
1136	wwahost.exe
1136	wwahost.exe
1136	wwahost.exe
4808	wwahost.exe
3144	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 3804	1160	msedge.exe	77
PID 1160 wrote to memory of 3804	1160	msedge.exe	77
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3916	1160	msedge.exe	78
PID 1160 wrote to memory of 3840	1160	msedge.exe	79
PID 1160 wrote to memory of 3840	1160	msedge.exe	79
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80
PID 1160 wrote to memory of 1340	1160	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa04453cb8,0x7ffa04453cc8,0x7ffa04453cd8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,969514164204694026,5125812883405313505,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,969514164204694026,5125812883405313505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,969514164204694026,5125812883405313505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,969514164204694026,5125812883405313505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,969514164204694026,5125812883405313505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1660

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=335789
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa04453cb8,0x7ffa04453cc8,0x7ffa04453cd8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7949402748557559051,881999897881723828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1136

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1524

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4120

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4640

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a3e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-2253712635-4068079004-3870069674-1000\ReadOnly\LockScreen_Z\LockScreen___1280_0720_notdimmed.jpg

Filesize
62KB

MD5
6cb7e9f13c79d1dd975a8aa005ab0256

SHA1
eac7fc28cc13ac1e9c85f828215cd61f0c698ae3

SHA256
af2537d470fddbeda270c965b8dbdf7e9ccf480ed2f525012e2f1035112a6d67

SHA512
3a40359d8e4cc8792be78a022dc04daed5c1cc55d78fe9cf3e061ea5587baa15023ce2152238f5be5cc5124cd468f220cf9dab54344d93edd3dfcd400b24469d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ec618c8c5adcf03e5e21455e43303967

SHA1
f11ba5dd40e5cfdf084ce4a4de7b7e3c05a23225

SHA256
ce0e01010d44b5bd8736349409d5a4ac078b1e2d5718d783a3c424be401ae4c2

SHA512
4ca2a24872f25e96d6b6df1114372dd8dc18f6701cc143ddf336be48ebe6f60e22d52acee8333da0b415ec5c707d7c620dcfeb820209613d7464e208be36de3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e2312d2d3de5fc9fd9dafca91944a6eb

SHA1
e54dbd925e5aa48dbaa0f53ac964fc983945aa4d

SHA256
b5481c10ef65de9fae7d58aafd83150b4b249298345c02b8f3232beba85d96f8

SHA512
0540be86db5fab4b17fefe42e5ad336c7d95032861d903a6a4940cc8a9a70f53477bfbb023391cb62c08b9cd9465c4a9513578f9c0ed43b1754cd93693581631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
22d528c24398079cb5b4d3040fc1bbf5

SHA1
a2152a0bde1b65ddd357a755a91b36b3fd7e6404

SHA256
1965a52d4b4626f61aa8420770f3a7950412924edf64095a9a7adcde8f087b6c

SHA512
3f5dddfcc76ad61fd00fc1c2e04b713bcc0b871baebc35bc43e892e5647cbb8cc4384801062e9195f9163e1c077b92ba7405dded6636839ff9ea73bb90d0adb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
92bd462470543a42d638528beca938e6

SHA1
d161a4a82b19b77bbe6e1849a124ae7573a3f375

SHA256
320c20e0595bdf32a808e9183ceabdfc1baa38155189ba02a2304e10b56863fb

SHA512
3e7b7a4786680aa0b14d353299cd43e70f362cdab9df6c2646da772892801f3749331d5a1f9b2bb4a385718e53f6bf66cbb02aa8b8727bd537ed59a2eef249f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
0baca4fabc78885dbc1fba394d390769

SHA1
57067e273915164d47cebcfc5514b9f11efd1660

SHA256
f1d2c958621395127b001e215bbb485b1ec71b326f7f781ed450ffe2f89a44bd

SHA512
b9a57e88eb85798b42ba5f9e593474a800caf443232ded25ed3466b8359219830d02abccb1b697757034ad493a11c61acaa0374fc0bfd7e5ae38c2727a66cfa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
fb650a53ec77f9ab954f377bfafa28fd

SHA1
865f3bfe89ead098f7bb413a625c3ccac89c103f

SHA256
027ebbe819fe686fa24b0fa7b13ceb11596d8b52bcb24eb4a00f73036cc654cb

SHA512
3be7572c9151c20cb2c448c7f334056f9f9618c5b90e358df437a3ca81c2d5141e53bb6a68690f96b2790ea3f440b9a74b5990837ca8972631cee4f031bd629f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
604908ff70588212dc02738e50a73b0a

SHA1
aa7c8743a450c8019a618858a95791761bf93b5e

SHA256
cd9c079837c8e990080aee22512a3c58ba74e8a48aeab49bd7f40e7483e883b6

SHA512
dfc9091f1075910397e4257ee1bfc701b837539ae01a729080aaa6a5b20ad1e46cc9fd0995522ac75a66d92ec482ac4a606cee32bb5ec78e6c5033b068e7594d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
6dac9d22551d828f1ee785246e7cf857

SHA1
a6aa7c048d6e3522745bef0755d926997f05a7f5

SHA256
0b472411459d0d7c4a93ad68b78c60f8605a0ea77718da2b9b72aaf7e94708db

SHA512
eeef2f53e53e2076c9bb1b8c4f33c605a38c6ebd552b2cefd3b1f145b898ae3d4a4f9eb257fec0a77d684636b23068bdeb8b938a93aa84295c661208fbaf0d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f76db4f35281a59857b3b4f987141cc0

SHA1
7a468ddb4a6f476376f886f6ca7a7a1313bc80e2

SHA256
2c8fad9c379887663d4913e2073b1521159221595800139cb179d3fb8a9869e5

SHA512
c3d8726b230c657cf43e7d464bd4ed64a80268dbe9b389e08715e955a38fde03ba196a5445e47f3152289c6f2aa27a04a882beed74f311f573d15cd772adeb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
6f7706f46a2c4bb635f2de1dbd935da4

SHA1
a7483f6d587f8898dd800c1c22ba069fa5b79f05

SHA256
d972393ad3ef23415c122ee02767fe0bc3aeca401f97dd6969f2d6d8af6e387f

SHA512
a4577a96e4e5d6377a38a757a52e92ef88d1807f2419ab8713b094e8b327998b14d99bf1f592feca5e525e5d8d227f2cda21ba2f9c43eb205d7c6eb9cb675393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
586B

MD5
626754825384e462cd70e08d171513f2

SHA1
a480a9dc56f5e687649ebbe20d2ecd80368b25d4

SHA256
f8c8e38837ea85b846f5be8630ad6472ac844861714453ebeda2c2a9f9580a8a

SHA512
6521f020bc46faa6aad94951882b046f5eb56a784c07d72f8f522c3d8ce37a7541461d8d80f26c8e7235298d89cfe71b70a813790e36ab89f7215aefbaece427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
28KB

MD5
1ddfb275c3a809ed2f1e2ef194c00ff1

SHA1
9cdbd0228642463a61fc45e133bfa2165d559375

SHA256
0b20585ab5aef998aeeac2ec60ccfc50210c61267b6772ecc96b1a435155e6a0

SHA512
89bdaa4e2d0db2d8a1a65021dc21e7886f8368afa262eb918939e86f1e78a00bb4ed2197908a5faa34c6843d1cff7cd2309aae859f92b14896d3d0b35d1ee027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
599af0d21dddb466e47abaf6c26825dd

SHA1
c1860e2158169e799a514cec56a161b5a80f0027

SHA256
91bb75fd59e2b41cbbd80925864f91edc878dda812bab1c53b0125d0343b0adc

SHA512
257f7acd0219bab0e5502e2a5f96e3a704bffeae6c0024d4cab8fc97304f542ade54b3abf1440fe2268237b96b689b050b9c092f9265a931c60c3c77ce65a301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
654cdfab86b30f33dcc012eaf3c20717

SHA1
37234076482a021397104df5553f21c0e6d96756

SHA256
9748cc96ef724cf797ba0735b9fa2a7120cb897f1d7ba399132e140b4feb1902

SHA512
597ce48e379e4464e37ca10f9a197cac8cc8219b13650389212f9e155ec3785cf909b5f0e4c4a53ca7f4b35b6f8579478cdd5dadb75988f01ae5b298ef2e26b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
986B

MD5
ffe705ce11199c44a199b933a29b83a4

SHA1
071eea35b7a6f74012ab9ca7e1ca9e69e435b92b

SHA256
2efcba0954b649e6b3ccfc8d027bd9750dae6215c06b7fad4c462d7e8408bb16

SHA512
aa3d563329e96451e5bfa69bd9b848258d215b4ca2ed2f18a7a3aab17c6bf18509d812cbd7565293e1fd4c8f629133b2e73e835352ac107a15271c7d56aaac9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec592ab0c9eba937ad732e641aded77c

SHA1
180f813fa4e8970d94a3507be90d80496569de0e

SHA256
51c7d6174efb6e4dafbb2671f015ee73e2189c4c37ce77917d11eee9dc16558a

SHA512
bc25f93563f88a6ea518b3b3096724a2fa74aab8d40eb06f6a1170f5309996ab754d1917820626634870c467ae4dfa52ab202d7d2d3ed2e2af1c1fb0d52b7067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0a3dee3d9d844db6095b10846d537e89

SHA1
4529eba510d4081b578e8e655c1812b717ccd2bc

SHA256
b3cc9fdd28e8ea2efded58696115571ba40021116d33fbd933b95e87e2bb0f15

SHA512
1eb1c2b1473fca1b08fddb4d3da02b4a9b20c181a1c9011e0d38afa9561295471c89da59e0f0ca796a152fc1eb7404b9daa7233861a713dc34770639583c4d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ccab406e2d5ef383bd1f7da4819319ad

SHA1
bcc41f012730af833de51c9887697d34d87c201d

SHA256
f3744cf901403d76fb713898ab6a4b2479ca5b893ba1be70bb121ecf9931fa46

SHA512
c8a4fae7264958ad50e8691ab0241f0967499f8a8c1454316dcc4696305615488eb7e61cb235f170f3079aee5b26c89e99cee00099a0604e46ba677f5b29de64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d632c5ae5924c3c60598aebb77b4977

SHA1
ef1147b60c1ac80d5d9647a087db990c3503ee7b

SHA256
e8b006091435504ad7b4f513f4a43e091c1444ee23a7ece888a0fcb36f7b07fa

SHA512
080a81f654591e30addd5e539fd1e937f51de997400be521641e616ebd72b59cbd5324a8c50e0af3cdecf21fe39fce09e53b1c1a59c3c0afca495c6ce21c3442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d94aeb2b45e9cb911f51e84813238e9

SHA1
d45b8ab89900057f7fff0913bb997b239b4d3acc

SHA256
86b7e74f202dce9f81d5d27558e898726f0d4b4772b447390bbe3afb64eaf465

SHA512
430a7a8876920b6c64d9348a66c9b9aca5c9adaf87285ae26d8c804090777c9a2fc09c3a234042937f6db54adb309cb6303a50ae894bac2d523fb61aaa30a7db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00eba6a54fed6e536a0873d83f46f5ab

SHA1
10956ceb2ad8e9b52e0a29a45755bf965f61081f

SHA256
e83e2186ca661f40454d710e491e9dd647428f34b2c020ead3ec79e386240698

SHA512
344b46e3ceb936d47685835124272954767f139421b5e2191f3690abed5b5ff7ee561de7c2c3ec946a38a60422fadf6b3b4abaca2ad8193c255b4cdffdf135bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
b43666b7f78f41d187e419e49f843a06

SHA1
23cc0b58a0a8716244ac057ec1cf950d9314453c

SHA256
fc7193dc115526ff2274f0e6ad938516f752a0232feb4c9dbacf64bce9ba81eb

SHA512
f31d28a0f4c1b2f2a6095e717b54ec4effccd799c555810f4b339716231be7edd675c3fde46636cb7ace9b754a5d3838414a0106b5b3d87af0f4871f21975fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL-journal

Filesize
28KB

MD5
0e4eb36a219a4955fd879ddf5952d910

SHA1
d26356fa5fa24ad42bbe606f9914871a429bb3f0

SHA256
c7ad6297e94c656bfeb57f0cb8ac8e74bf5b8556c4334beecf5fa7c940dc34d3

SHA512
dac5478bed0869b0a27936a574fe19d7f69eacb379ccf2a8c1f5873a83bdcceae7d82240b4d85398ac4087b1fee6ede09a7f471b3343f0cb8e995d206cbee269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
137B

MD5
a62d3a19ae8455b16223d3ead5300936

SHA1
c0c3083c7f5f7a6b41f440244a8226f96b300343

SHA256
c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e

SHA512
f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
275443c100fcd34b2655e25400202f02

SHA1
d940578b83cfec6fe0c7b9706c0c9aa0a9ad1184

SHA256
da0ee1c1544960703d7e30f2e06ad5111e0b6733f303cdf6693f7ff42ea124ce

SHA512
cec90443c625f3388c950509bef9adffbe352acf00fb15e4cd82f3d6bd25f89131f0e686afd29aba3ef9a75fe093f9cccc90ea1c1ef52ae23a0a529eea18c080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13378582305629210

Filesize
1KB

MD5
0c588376f5564e462e9cf119a68c85f8

SHA1
ab9614574ca140470b25b3d690583704e65cde89

SHA256
41e7dcf58f4778a595cb11b9bb1faf7d205539d58cf01334ac538c33cff8c9b4

SHA512
50c0023f1c6ee4b23716164a9bcf4b20164dc62edca3e2a359d8d3da5dcad6852581484137166e7f14da649b8e6a2ed5a802e527c1c69cf4f3c409ae31fe851f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13378582306506210

Filesize
1KB

MD5
ff1bcff0c7c4f29fc2501e640e0b2e24

SHA1
813309069aed0d7b776685cd2f06c085cbcc9ec4

SHA256
5b3499a562ce7e9844973d8e634ca174e6fefe2f2384a0e234ab3ec58fb5e269

SHA512
033bec303bfe2b10695e5c5445f86c3d53a783b6c71f36c787f0dec8cff09b4509db9238db7ea231fbb2bf6ac7793bec0cc0e20c09a156d5df161d505e9691ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
978cf65697f35f8c767f44507c43c776

SHA1
d848f273da0e8fd700693a16c23a573d33c2d502

SHA256
26316a0d1858887dcd35ba59a4ac8bf783bf7b0d82da40c690ca5c89cdbd3dae

SHA512
dc3efaa414fdcbaccb3d2c2b127012fd2b0e0e8ac8060434ff9720aac2715c562dd512dc4a45ca28397657f0b63ed92cae88c4024ffbc06ac02aa0edea84cfd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
71f4f2e779b80b40afb09c0329b342af

SHA1
d1d3dd5a9758797306e009bc31b189c89bc5e098

SHA256
ac103ee8067ed1512e72638be916625aa040d430e3c8450df9cfeddf1c00d116

SHA512
28df1c6237d11f0d5a4a0a6fbad3ffb7ac88b7a75ec0e444adaf316cd1b0eed1edeee9c9f2f90c3b981019d5d1ccb1c169cfa74d19b888c628cfb43ef986751f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b5256e7b6d28c4a5566aefdcb39a6721

SHA1
774a9c100f446ca9d4644382d3bcc9b48c98df9a

SHA256
a0f8d1fbf2039e79646c2bae97c276aca190370b75ade886c265c57274660871

SHA512
042c07d592aca7b2c4ea0f5543f55c7b16addb83c7cbf11071d411231e2a4c2b4cef5619db9509dc03f71a76d8401e7917e0693f02bc4550621b0793d49306e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7570e7010f6c7fd60997fa5049b08106

SHA1
c842bd69916e505d2856dd967b7283526a19c5b4

SHA256
b7fb599e88d13fe71aaa176b2e85ab69561f9a0e5f71213f61e6520f64235ad5

SHA512
671d997d4eed00c497b31823fcfba3cb2fb200c0b32db4855d2b13230a14301b91b13f2f0544136e419fee8e4772fd3122ba44b885ed23777865df2fa36ca778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
abc044f9bbc1ed63ea7a9f938bafb696

SHA1
2340561d186a0ce385c680bbf071df70ea9f8839

SHA256
1db89610ffd1ec7b6aef0e8c3b2ff78449d08a81f8c3ab8a7e42668903b1da74

SHA512
a7237cef751e4d9c691207e5fbd95691467d13a14692162fac926532cd48f1b2859b90c5caae7b936ee0cd0db54a2b424698fa2f09dc90c20b78284ded7e655e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8f2e8f9c22b8b5f45a7188862586df20

SHA1
d2996d927cdb0a5d559443d3a415f9c0f8d3c00f

SHA256
f7f9573e9b200f01951b4b6396dfc36205e98b77a8d1efcaf06cd41fff77f691

SHA512
5dd7ef2e6881f890a4c361dd13cf64979a1cabd4bf72c036100564f118d595e0e1145df45200040713708ac4887604f57b6dc55e697b51adc9436ba76ce4658a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587942.TMP

Filesize
1KB

MD5
884ca372b04bef0b7ac24233fa5a9472

SHA1
505402e5170114137b639d780007cadc2d662aa9

SHA256
3164a87ccd15ba15eef94853a9771cb938dd880e46ce85628c88764d2ab9686f

SHA512
b1ba7d302fbe38110cc53ccadd391a39f5ef342a67eb560db638f9c07680f882ea55a0a420a66b0ff77535271d521f781dafd3cd8b497976a4f209eb0943cbe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
264185ae6515e05b29ad541301cca613

SHA1
626679587f09de174ecbba602a3c330147037d93

SHA256
448712751ac258f59524b4706a7e3d47b109c103a04ff6a247d35c15fff68ea5

SHA512
bda94585b9b2df016e0c678d8921095469da032c8f93c3e9542350eda2b23c7fbb86a4d882f814281ac69795baded1f206529ca482b4a5d1d9ae2b65dda6171e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
d0fef23f2f9592ce07160df8d50f6264

SHA1
0037e757a227a97f560feda8f70ab48b54764e24

SHA256
93e902c03d06a7b16f48f95a619d02c087026b892810d88e65ef22ea0eb4607c

SHA512
293af440978ee6349b5104c08f85a6605a13176238d03ebc954661e413c10628d0b52b7349de03ef80507ecccf5dab36f008e7e83a303b6ae7f7d522c5fcccb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
e11e8f48b6bad126a87c5798d112f2d7

SHA1
06f0c2001fb88a5833ca7fad567579895dac4c66

SHA256
ceedff24f3aad897fdd02b1901cd45f17153e512942cf4f1153b018aa034e3de

SHA512
5dc247fbc9d269e356a8fd78c2c08a6110d60a7b15e02ea7a36cb29bced2f9516bed96c54a341786b0272aaa29567e0ab5900fc1140e567f31ac0b9e862b7dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
68dbf3753a7f8396fd255d4765c30438

SHA1
c21fb86daafb75a34472de75d7fa6814625d2a3a

SHA256
00bc94432052f7f16a0f1ce5add43cdc8f4f63b149ed64200353eeb1c5762171

SHA512
4cb2c5d524301ce260187357ca2312fd37e59e3437743706582a02b0b8923b9bf5e0cbc0c0257730a5be9e2298ccb624dfab86320e072d316354fa5d2bf7afcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
f3fec6763f5840c359eca828c5dfe4b1

SHA1
27427189f8d6e086b5f661e55aff0c418d617002

SHA256
9c5b03cfe8bf8719326c45bd944848be51ee88b63ad9d7bf0f5967317c76d0f4

SHA512
9051bcf04c0d06db6a0ad48810e7ffcb7bab34cb5616afd6d79265df75759f8c9d3841db321a38e28becd854bb0ca3540761073e6ed8797ddd54a87d22cd2529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
1c1e2b0d836c73d9d7cf387ebbcb0ef3

SHA1
858914d9dfeb109813bd9685024723d43e9a5631

SHA256
dad990898a0c45826e59e37ed72f119b18b3a60cc27dc5097c1395984613f487

SHA512
98f9e74c648d4581bb59ee13b7265c3ed73338c821f6c7ab7b924aedb06d0f23192af9402c6792c6991671ac42547c99fc9edf2d8622695e43c459fa2d73e7c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
9d7e74824a5c7f89e19903efd744b15f

SHA1
57b74420a9c466422dba050f918c6a09280845b6

SHA256
0d101649ba96491432eae7a7cad052ee2c58f3df77f5d370b526359704e5a6bf

SHA512
236714e299bf6fa5f35f4fd1f5de3e040051c9ea5940172ca9549240de7ca76fc425109cb0465c3d553412b4b70202095bd9b03e81fbaaa36fdec4a7667779d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
20KB

MD5
7e86d5c1bf2ff36b15bfbd8fcf748b16

SHA1
59a1515ddff8caec85c4f27ffb17b69a42ec6226

SHA256
82f03e141e82546b261c1a24cd9ae3cfd4b19a7b4f343a296428deeda88cf856

SHA512
943fdf966d2ca4bfb35e01431e7bae1611e86d4bbf9c27524ba4502a9a93b8c0bb39e7760a8ee76993c4099da1ff49febe0b48468f134d4121f22a0ffb41bf2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
20KB

MD5
2a029687e73114ebcb4fad10c0114e8a

SHA1
f09cbbed46b9f8c731568bdcee13024e89bda397

SHA256
fe6e92a5b020858bbdd8089533c6f22703bc5927e22f689c384164096705b11b

SHA512
211dc45e2bb5739bcf863c44ca8132f92e895b3c95d074929aa4338698d53c6ccb3a8e2f23180260d9226073f4f5cd21a200010a7a224de7c8ac2e1cc853730d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7bfbd72d78c8097a601b068c74a066bf

SHA1
3066089f2dfa6571d066d1cdacbc9932fa21d67b

SHA256
3ff5ad131acf09ada5002454db213ca4de6fb1b2618122622aa8d2512556b5df

SHA512
8a0206424f78fe69aab455290da8191a7a05a2cf3fba24ec55c77df4a7c795a11eb74c1ab31ef99b2afc05604e4a3108d08168e8ebf584c03695e60c0fe60089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bb1da21410efa233e762e63f7b5d93cd

SHA1
cbdb7514abf2f5a10c98adb5a0a0bccf140093e9

SHA256
0e37c6c94a62d93cb7c29539e45d0cc5da6193e32cd2d221656e9ef38798be73

SHA512
291756cce7879cf210b741864bacae1abe6710f1406c7eeaaef348118cca8f205b393e0e599ffb38dd7d2e036b7c68c8f05c43c014670c9d35cec10eea6beb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
26da270a80ce57cf768b6921d07856e0

SHA1
b7c3444ceb204bb877a34adacaaafd425dbfdf1c

SHA256
2413430272819e226f1c1e021d82f1bc1ca98fb901309c5ccbe5f8c8eb8123b3

SHA512
e5df565e1d3cfc580159724c6edb9c676229724f4a6fb99766f2ded54e7556a6939a5bcb7341839d6d7ff43ccfcb72d74d4d93df3d4318373a0d346c5310df65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
542cbd0c2b228038481dd5faae3de13c

SHA1
3943ddc34db0f503133f7f7db490094d1fae1870

SHA256
a5e660e51c502fe5168b9ee5dfa96f6dd840da7203aa6c7c8577473628fb2542

SHA512
95d2dfb283ee271daf0d897570a86e3e2daceb947643dd532f223f9c9e0a985cd931b3ee734769e91caa460e2f354a68f23afad5acd27b1cadc41aa3d32ae4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
5B

MD5
066a337c06aa1cde2abd6a084c857652

SHA1
b967e6c8d9c39128084aa3c38e1b593987cea828

SHA256
b17afed3cbf137de2638510ff2d9078440bfc08bcada56f673d8f1f36ae3cb7f

SHA512
58436ae8712e278fdc2cf0e91b9854daef0335d41341d67959ec3b2caa0f44ddeab6052e97520ecdbe88e8202cdad762bbe2e513000a9162265ceeb41862c5fe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\20C42O6K\2_11d9e3bcdfede9ce5ce5ace2d129f1c4[1].svg

Filesize
1KB

MD5
bc3d32a696895f78c19df6c717586a5d

SHA1
9191cb156a30a3ed79c44c0a16c95159e8ff689d

SHA256
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

SHA512
8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\20C42O6K\oneds_MC5gQfpbTUjLu60sQCwU1w2[1].js

Filesize
266KB

MD5
302e6041fa5b4d48cbbbad2c402c14d7

SHA1
66273c7a4d569c1c5e566d9bf15af4bae6beeb83

SHA256
6202c1621c9126a5089e97e5c1f092c6ebd2271875015564cc73957fd5e8b758

SHA512
c7af9f4318f7836de8bfa75f7546ec704255403aba5b1fee35025b0a1d821d813bc50d75f5db2aa6bc25df62aca0a4f6515511adb6aee4a1dfcba7689fa735d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\21K28PCG\converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2[1].css

Filesize
93KB

MD5
9c1139152aa7f4aa47e386654dcdd5a9

SHA1
5ffc6a9e66220c6f829a8bd93eba584079852992

SHA256
2518655800698c89ae0bbc34b3b362c13e558bcb3ea4bd6c2cf4bbcf9e87b927

SHA512
cbe632cbafbe7282f951fac3f5079dfc658c583f6e93a1917527c749512ff8464f95ca37337e0bfd1c96b1cf3c6ada4a3b0db89e7947261e748c55603af6ec6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\21K28PCG\favicon[1].ico

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\PM808UN7\datarequestpackage_WhkJOChfZHHxzLggwuParw2[1].js

Filesize
7KB

MD5
5a190938285f6471f1ccb820c2e3daaf

SHA1
27dd715f7d1d143f21530650971ca8924f0399b7

SHA256
ee4180842490651a8e31cb587a0fd51cd3f14bda61da34cbbe84af5e56cb3455

SHA512
960b0a6aa35312570f7f661d55960a66f849b436401756977c4d5dab45a0e6bbea67bf42c21002aacf9335af1d0d39e4534ecd8fa0bb09927df0f018f68366d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\PM808UN7\microsoft_logo_564db913a7fa0ca42727161c6d031bef[1].svg

Filesize
3KB

MD5
ee5c8d9fb6248c938fd0dc19370e90bd

SHA1
d01a22720918b781338b5bbf9202b241a5f99ee4

SHA256
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

SHA512
c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\AKOU1FLR\login.live[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

Filesize
115B

MD5
a19cd759b78f0257278ea48e6b417618

SHA1
2994a307e3609c3dabc52b7ea8a2cba0a0257a3a

SHA256
89e4e79a21e5bfff3794d477d0997c976a66eca9ad91276bb08c77efb9953cf1

SHA512
67f93708e83a73c52259503532ab9a46eacc67586080a4b1951f5e093685cd6fb26aed7218cc7d3b831f9afee0cd18c03debbbd8af6b71983c8a05b6ecada0a7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

Filesize
117B

MD5
6da9978b3c1d2ce97ec3912c11cba0a9

SHA1
1e1c095c35a5148cb44e078cf35bd75fd3e27b79

SHA256
5977a6b1614e855535909371271e0a2d08a08aa6330407cdf70b0dbde4c277c4

SHA512
22815edd3557085a782bef7fbb6b6986b9422172e19176cd44cb0bcd9aa1c6851c15b8168ee783d7b1fd53ef62e59295a6f77eccd72cd7a2366f50ca8c956d6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\5577871a-1e81-440c-957a-bf163b0f62a1.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
77a8b2c86dd26c214bc11c989789b62d

SHA1
8b0f2d9d0ded2d7f9bff8aed6aefd6b3fdd1a499

SHA256
e288c02cbba393c9703519e660bf8709331f11978c6d994ea2a1346eef462cb8

SHA512
c287e3ae580343c43a5354347ca5444f54840fba127a2b1edc897b1dfea286fa37b5808f6e89f535c4022db8b3f29448aa4cc2f41ab0f308eec525a99fac4e5e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
0eb2408dad9b6c5c2af0f3f770cf239c

SHA1
23688d12253707cff445ae527cd73be6df353167

SHA256
d1e0264cd58cf2defd8bb02f09cff5545e232bdc64bbfd9a719fa64febad8412

SHA512
34261bbe1ecdccbb5c1ee70f6dc8ad17a3933fb5e911b4eb53c7d2680a23f2a258cd910ef640c0587b52ec96fa008c49d46c14f5b480f48291916f0822e01f6d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
024bc48a87bdee30e153c6a9dd962480

SHA1
8b468ae61d41169a0afd885812bdde2d9b6e2537

SHA256
da54fc12a17b732a5154e14669fa55a9e64aaac770f14e285f8e63aa9dad9b5c

SHA512
ae24d00eae2e5065e40cc2239f54ba53bc90d8c41f416a747286aaafbb08d1ef3d1d380f1363765132e8b73689365e97d39ea44f6cf5e6212bc8077f5eec48b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
1f4778cfc173492e98c7b9986a5b0285

SHA1
e169eebe8d02e60b6a1dd0683c9bf3f367c6011d

SHA256
cea51f689f46df4c422cd4311f5741713ca30c6766228fd2f2354b760afde0f4

SHA512
a76c3022d330bda3d8f562bd7a52fc41e8fe83a6cc0b547053f87ea80ccd8ae571dec9b58a6273c498ccb7f06cbe817d47364e0208e27c126415dd6b80e0d094

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
030b68db7ee1939dac0df0ff6be92092

SHA1
2b02ba140517bc9faaca1f1c1dcb027e6fa475ef

SHA256
a6b2f0e5c0e4cdacd904dd7119223715ed87b7d350463664c3fb97bf3fbb84b4

SHA512
ce70d6e8d87a43457b77f91a83cf731faeec833065005eaa857bd759920f070e95a855b0f7617f642bb74b4c6d5c82f988a66f4e8ca9e47810f1aae00cb8db32

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
a05e3b886e0b2ebe1d625bc44c9c48f2

SHA1
7c27bd9092bf9eed68938144a93a275965faa76a

SHA256
2db51cad9c9cae3e732a0d42087ef1ae5b862bbf7aeb3b801c5b9179a57422e2

SHA512
9b2ce8cd78ccb9c84a3c3e4fcf85cd1484c407c9b2029adafce2b702fe162d26a9af85033eed860d86eb3e33c1c1aa281361160dd335275879c297b41d6071bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
801093f71da556b3354a2925ef109c17

SHA1
1cf78cde0b0866644b43950a85241e155a01dbbf

SHA256
4087259ae931aa2614db65b2efd8c08372f4be5aef841e3205d9b6aab20378d1

SHA512
9eb77722ef58a3ec61a4116388b91d3ec1cd0049382ee64771b5d77321d696e54d4ada6d037dd6289c5c1b3150aeb5d7ac89d1059d3aa94be53dd565c774ac96

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
b780110e2f8767fdcbdbf11352574df7

SHA1
b62979884952668b93b4180b5dde56ac7d667877

SHA256
7a7cbec8effb02ea5e6eb957ef08b821989155dd6d30ab8f316c12afe051dcfa

SHA512
bbabeab90c470320f789640d10d63e2d307e3fbdb606fe531f0f285a381042f3ffc1676538952ded1196ffcc7b222752963c1f28b6b939da52a4e6373329a5e9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
d8c7edecd4f6142912e647f9959c821a

SHA1
2d9302ef775de9ac8b7195865cbb241e53f76418

SHA256
98accc35ef9f944e8194ef8d6683ec04ac8f5473b181c3ca8630b50c2de9f439

SHA512
3b91e1bc185d560f3bd4fb1a1f9a673252f7e6d073ed3218cfe905d0ea75b69c6932d46403c78a549512d2306184c342cdd28817b520a1e5e80edf28e3d6a5b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1136-1020-0x000001ECF7A00000-0x000001ECF7B00000-memory.dmp

Filesize
1024KB

Download
memory/1136-865-0x000001ECF6A50000-0x000001ECF6A70000-memory.dmp

Filesize
128KB

Download
memory/1136-859-0x000001ECF6360000-0x000001ECF6380000-memory.dmp

Filesize
128KB

Download
memory/1136-731-0x000001ECF3D10000-0x000001ECF3D30000-memory.dmp

Filesize
128KB

Download
memory/1136-2334-0x000001ECF8900000-0x000001ECF8A00000-memory.dmp

Filesize
1024KB

Download
memory/1136-1015-0x000001ECF7B00000-0x000001ECF7C00000-memory.dmp

Filesize
1024KB

Download
memory/1136-2197-0x000001ECF7320000-0x000001ECF7340000-memory.dmp

Filesize
128KB

Download
memory/1136-2188-0x000001ECFB770000-0x000001ECFB790000-memory.dmp

Filesize
128KB

Download
memory/1136-1986-0x000001E496770000-0x000001E496870000-memory.dmp

Filesize
1024KB

Download
memory/4808-3053-0x00000224E3030000-0x00000224E3130000-memory.dmp

Filesize
1024KB

Download
memory/4808-3266-0x00000224E5380000-0x00000224E5480000-memory.dmp

Filesize
1024KB

Download
memory/4808-3508-0x00000224E6640000-0x00000224E6740000-memory.dmp

Filesize
1024KB

Download
memory/4808-3258-0x00000224E4200000-0x00000224E4300000-memory.dmp

Filesize
1024KB

Download
memory/4808-3130-0x00000224E3850000-0x00000224E3950000-memory.dmp

Filesize
1024KB

Download
memory/4808-3666-0x00000224E3650000-0x00000224E3750000-memory.dmp

Filesize
1024KB

Download
memory/4808-3720-0x00000224E2E00000-0x00000224E2F00000-memory.dmp

Filesize
1024KB

Download
memory/4808-3097-0x00000224E32D0000-0x00000224E33D0000-memory.dmp

Filesize
1024KB

Download
memory/4808-3042-0x00000224E2E00000-0x00000224E2F00000-memory.dmp

Filesize
1024KB

Download
memory/4808-3041-0x00000224E2E00000-0x00000224E2F00000-memory.dmp

Filesize
1024KB

Download
memory/4808-3037-0x00000224D06F0000-0x00000224D0710000-memory.dmp

Filesize
128KB

Download
memory/4808-2932-0x00000224D0240000-0x00000224D0260000-memory.dmp

Filesize
128KB

Download
memory/4808-4086-0x00000224E6480000-0x00000224E64A0000-memory.dmp

Filesize
128KB

Download
memory/4808-2732-0x00000224BCC00000-0x00000224BCD00000-memory.dmp

Filesize
1024KB

Download
memory/4808-2733-0x00000224BCC00000-0x00000224BCD00000-memory.dmp

Filesize
1024KB

Download
memory/4808-2734-0x00000224BCC00000-0x00000224BCD00000-memory.dmp

Filesize
1024KB

Download