hxxps://landoltit-my[.]sharepoint[.]com/[:]u[:]/g/personal/fredi_landolt-it_ch/EWsXGxqvVGxAtOpmLv7b_5YBEPi4ACpG4KOYyhlTpypq2w?e=DjclYV

Resubmissions

17-12-2024 12:39

241217-pvywpszqdq 5

17-12-2024 12:32

241217-pqrltszpen 5

Analysis

max time kernel
928s
max time network
928s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://landoltit-my.sharepoint.com/:u:/g/personal/fredi_landolt-it_ch/EWsXGxqvVGxAtOpmLv7b_5YBEPi4ACpG4KOYyhlTpypq2w?e=DjclYV

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
544	msedge.exe
544	msedge.exe
2908	identity_helper.exe
2908	identity_helper.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2936	544	msedge.exe	84
PID 544 wrote to memory of 2936	544	msedge.exe	84
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 4220	544	msedge.exe	85
PID 544 wrote to memory of 3608	544	msedge.exe	86
PID 544 wrote to memory of 3608	544	msedge.exe	86
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87
PID 544 wrote to memory of 3484	544	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://landoltit-my.sharepoint.com/:u:/g/personal/fredi_landolt-it_ch/EWsXGxqvVGxAtOpmLv7b_5YBEPi4ACpG4KOYyhlTpypq2w?e=DjclYV
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92e0746f8,0x7ff92e074708,0x7ff92e074718
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15914824837298776351,468445953904551801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e81a923-33c8-4788-bb36-71af1d59079b.tmp

Filesize
2KB

MD5
4da8431dd02498cf19ca82a7701a0f7c

SHA1
8db17138261fdbd919088ac981ac280eb6ed00d4

SHA256
50e77e5a4bb4ee1cfa3121c9ee716417c7b41588c77ae2946b103688bb2b2b42

SHA512
5f5622dcb32c0b23154eb1539fe2aed36e8a2687221e1f36f5e8d184521d9c8971fea5aecda94018e69c651af438c01e045888ccbaf7ac6d6ec0f4b4b90b21ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
19KB

MD5
3ba4d76a17add0a6c34ee696f28c8541

SHA1
5e8a4b8334539a7eab798a7799f6e232016cb263

SHA256
17d6ff63dd857a72f37292b5906b40dc087ea27d7b1defcfa6dd1ba82aea0b59

SHA512
8da16a9759bb68a6b408f9f274b882abb3ee7ba19f888448e495b721094bdb2ce5664e9a26bae306a00491235eb94c143e53f618ccd6d50307c3c7f2ef1b4455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
672KB

MD5
3e89ae909c6a8d8c56396830471f3373

SHA1
2632f95a5be7e4c589402bf76e800a8151cd036b

SHA256
6665ca6a09f770c6679556eb86cf4234c8bdb0271049620e03199b34b4a16099

SHA512
e7dbe4e95d58f48a0c8e3ed1f489dcf8fbf39c3db27889813b43ee95454deca2816ac1e195e61a844cc9351e04f97afa271b37cab3fc522809ce2be85cc1b8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b8c1d59c75f7fea715acb5ec7382c552

SHA1
b49e642888b78a93944181f493b919f8bdccc5be

SHA256
2208199ebd07ade5b59a78e56c3168ed558295beadedab5e130fdbde0d63481e

SHA512
0255907cb8f0c177cea49cd510d7ce82872523e911d8a4286d077aced5ac896c2f28defa878d0626adf5cf5c19ace9f0ff7e429b50337add0221022cee139952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
42256ab204f04f7837a1b3b2134700b7

SHA1
d256e2641d091bc25e836e524a46913e86e3b4f2

SHA256
8fa8bfa2668a544822b2b26f6e48c35587c4eac175ea6b5e321f622f4040da57

SHA512
22f609eebfc0a95a00325b0f7579ec132e1822b3c53666e3dd6712de7d8c1168c5a893d201772500c076abe5916018c51d0cccae7f79d7875c38f250e1eb3bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
08f9b841b173495d7ad8d13396e7a9db

SHA1
22292a3d73b36779efa72c44bad84b5a7b4edfea

SHA256
be0fb0d1ac585e484aaf54654a7828c8970803fe90be73998835c7e9b02b2d93

SHA512
ae78f83c2670763e612ebe4a00790d4267736020db98ef90ee0bccbb8966e56d196ffbc74bdb30748dd448fbf9e4fdb601b06cb7c89fde5b1a4d3e5e70abb5d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
973040e2cbe0ab4c1ebb622c02f963c4

SHA1
69d98a007e1929cd5e4aa60b80d54358e4667496

SHA256
e6cd27f86132da59fa65007b3f12feea9bc31cd261235e6f34558269348f4272

SHA512
c4f007f5f26a75b465065d0dea036c8941107bb77a79f77f4a9479835052e388258cac33408804024598c74dd8d34e110d7f2bad40b361c6ec7e09e828995096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e0bfe4b1cba9b3fc2d51ed408057430b

SHA1
4e53d53a78e88a9dbe6951f7d4b4183733579cff

SHA256
a954dd0bfff5ba2c77924f019b1916114197ab433abd4d350c58d1ef352bdf9d

SHA512
8c91ba8944eccf234d3ea0e6b5e79fc7981989ccca20dbc7ed9383a26d46a7a3a9c6928da07d46593fb6efcd6dc2ffcb24781a6e7def679b0e649a5af96b1803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f5394babd1a9437239b8ff27e4f85d92

SHA1
71038cd8bb805d6693c7b9dcb7f3600cedddc8cc

SHA256
f46322ad5514e45e28f9b1daf6b1a06a9e5cca44f4cf14b419c4af0aacc1bb0d

SHA512
699f42fb79ed42511793090f5ce152f9b3686ce5bbcfe2ab2cba1dbd323f9b9946c07645a7e55244602d4fa969b436dd327b4d11a29cbc6a55a058b663e0742d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7813094c2f6f97611c5f844bc2d7d384

SHA1
78c426616bae22eda6e5a36e70a5e72b21279037

SHA256
fbaba93c8ddc36bbf760671827783f40cdaf4cd79b1d8091685d5b8cbfe17946

SHA512
4e489b3091d44373773b4bb341ceaf7a80956c62d068e9246496ea341855ef1bfcbcaa663524845032a4942b3891189970278ea6dc4bd6ba65d5f1068cdd6b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fc026d47a7eedb4240e7c6f2578e7bcb

SHA1
3d25b937bd6dbf3d13c187606f7e9116c0f61d9e

SHA256
f1d16df60059cef5b3ac15fbd3a11a249db2779cf993434a405c9da10c002fdb

SHA512
7c1fbad36bd8358e31c84bc42f4b199e5e5dab2e11d7b9e63ef4950016015698bf38d1d3370513e53387b1c75aa1f031084ab0aa2215b05cca01d4d3ca143f4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4327e11a07bbd45b49d87bffa6801e1a

SHA1
752c88e88c6aafc848608a9d878d2e90083daf97

SHA256
0db627cfcf8d6865a3b3b3a072ef60effdc89d32ab668aab42d72652c21602bb

SHA512
41dcb77eda3de096f85afaad5b920bb2dd891e0e5025c22cee4b74851a158f3e00c8326f72ac5fd38a6143cfe3721a4c2b56021638f2fb7b82433b7303cbfcf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0c7cda7a70f1f60317aef0000bd9da45

SHA1
0e9b29d6e4e5b80d8cc2756d6fae8e5d82059fd9

SHA256
5350f734bd39bd1ae6ffecb2fa7b75838f748c570b0953cffb1a1eb0b6333c4c

SHA512
4b0d1c88cf822025569f77bca2aaa0afa7834cb2114de2b054b11f125d941d3996573c4a0fa1ccd47e6ad9d76ae135f85739ba1bbbc67f007db9cf631f70aa54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
67a7b31083dff61b68d9c44fd0a2eef9

SHA1
979a313d190466243622ba774e9386115fec82bb

SHA256
24b9311331d6fe70f6164f64e1335db210ceb76c7b13bb3518ce2059a1f4f2a4

SHA512
6e4e5f051e842565af02f7c350d54ab005f9f4e54e9e6b2418b24e73d1fd34ed40d616e28d7fdd5feb6624f6afef54926fc743540c29cdff200ef4b5213514cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
506fc089b9737925b19f1f0c12ca7776

SHA1
5e597f511b7e55969ada42ce764ff426b599d640

SHA256
b2b0e1531d3e353b2f78bd980a18f5b1e54b87b41c6b65397403f3958115ccb2

SHA512
7d054eb7d7b61b9a0da8a74502c0a1d9a8ab83116325d48dca1d9108ab3ac6fc5d325bda96cfaae3ff1f9b239ded5d07e49b88ad2f4c84ed640f44a83aef3c0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93406fae147f7be2875a1814a7e15cdb

SHA1
80d8e506321f9a519db151a1819ea1bb828c593c

SHA256
746c359e64530150f63e3c3a3adc089ae93dae7867fec52fb91319a0dff56b01

SHA512
b8512124b0405dfab8edc29de126c2d1e8228a08aa6007f48471d9aabdece8da93f63721787c727428cbec87aaf312cc1296d53948af0844ab0fab00e29a6a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c0bedf8e9c8792b0fd5e284e8752327

SHA1
876067506bbac9a851742f86ef502e437077e4c3

SHA256
a46067b2a965535d3cbeafc961716484cf0de3162523d3a5e3bea05756112b4f

SHA512
860c4de341dee8b15727e093ee7f3d00c93d1f61071862107a34f6787acebe76d47db5aedb985e98d9e12961efccfa50422800c84baa00e325199984ee6914a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
139a63e869eddfce260f1f846c9ddfa8

SHA1
0652202e2b1e26dad998fa685e6378f20f6bfab4

SHA256
e48c3ff4d886f5036167ca68b5d9dff865ed4a8c2d13c3a31a18b3f3fd818085

SHA512
c897d40d1008149f08d452941c9968297518acdfbb5bd278a3a9edc27cffef1a83a307a5078c4a0cc6b06150a285db6815f1ffd0b2b86081cfde99afcb657be7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6706fbaa69155b531df7eccad1638f5f

SHA1
742e99403a94f88412bbdb6d365e9bee283087af

SHA256
8203086c828e8b0a2fed8eb08e7a028aa89b37c14ed3ad2e859594dbf8bd3bd3

SHA512
68a836639fd60d06f2aa1642986cf97d080ff65745accb9d13646c5c830f65ccf2c37dfffa849746c06123813c3f2bac65a52c3870344e6c3ad9c619af113dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f8db6f6b72d7a07231774199bd5e3375

SHA1
cdfef046f1fc7a143fe59b2edcc1106ceb9446b1

SHA256
057cfd75f47c567d25d9ee3bbd40cd294950651a82d9e0e4bd0199bb3687a28e

SHA512
ef9cadde6b213ad2b9cb7fb2f6bd0b86aea812e7b3c49dc368868f2a9a5186697c49851efff01137fa64abed58a796f6092ad7a2c6d561fc361dc95a39965cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
69d5d48c3d9fff443f115367cba5b74a

SHA1
4a64e2a4975861e624a3229cdeaf26b2d95c74c9

SHA256
7ec4f06a03ec9b7341c3413185d5d68436e9d38fd03164b4f27c4bdb66e6742f

SHA512
33f190361c485a183149751b765ace58b8d8fa50c7c72986e840f40c61b41d2ee7f2012b403a98c48ddef04d7eebec22d10aac7d0a24b30ea69c2d30c89f7da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3cdf00199773f89c0a9f2bda06ec8f1c

SHA1
7441ef272c1a81793f48b80b2332b24f1f2da349

SHA256
4623fdb0f424839e17c2653dc891afb5a7d4ae557dc884cdade475d45a84a210

SHA512
b091598ba42824375cb13c9a7562892722bc5c71bd66c84fa52f5a077ad1ea4ad71a4028986283401b5f65e1f52af25f495e32153179f701431c3a8a55667651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
afdebd46e1b77cc1bbe12a78c9c7f3b3

SHA1
e3c453817b91ef2f83eb1b2f57a4f37aa21d4d8d

SHA256
dd3fb4690e26c5d60a2e726afe214c0d03452a6a9e11e006a041999cd45ff5d3

SHA512
fbc4dbc6f4b763d9b6d1f9517493f110a20bb4d3c2aff80e66bf0e0bdb261eabb0c5f004d44b0cef261e5ea2e23655c43cf575a39680c92724fae6dc85342b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
95aaace97b80a9778f5944d658be69ae

SHA1
843a007235cbd34a94eb02752173b810d0a8f77a

SHA256
5db6f5bb86cb5003c5e7fadb6d6fdd5419cf9acfabe6db553456650884f68d3d

SHA512
73061cff7752c7989525c79c278dbead3ef427fe97ab6760f04356d3c70edcd5b8d23516032a9be3e5cf11bbc2b457720f2c6067f3414b6a30ac84514d5bfb03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8e363d8cc1a116bb50dc2c7e80291bce

SHA1
198a745fa87108a2230428dc93543c93ba9489bb

SHA256
ddc617769e96b8335c134328d3c4dfc71e8c7ac01969be4a963dfdfd005c706f

SHA512
4a8f12a724f3a323d4ad47d108df0cf2797d8ff0dc4e59fa41002777aaf0df26be77a9c526ca86b62065aa1465d579541a02e78940af23dfcff7086547b397c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
085b82e56e6325332774b50c6468f52b

SHA1
e6f9c74ec160d652778f57f3b72ef25efd842040

SHA256
830bee161dc84a4cdfb86e104eea2c37791dafef2f86f337445cd1aa0c34f3ac

SHA512
b0b0de18683b8e7b5067411bf26ec6857ffce0e4ba02c3f4ecb88d8c472fac4a0c3f06acf137e9e621c419678250b03d97e2ce89fa90bcef0ed889bfdf257196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c09fd063f8e4d32885617b495aeb3766

SHA1
17732f7533d00062d0c1d989d71b447e716fa1c1

SHA256
f9881188c793a12abc6aea220f2f2850f3bfc3065cccea188bc5b0b0b5317dcb

SHA512
65b270a0801a449b57458dd17bec1555afe1bae3a0018366b1bde10c4b727e50d9d1e7d25634580b709657f5369647fe5a22149f347c30b437b06770f5a51868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1d7728e9e742f6c47494d6d732548e34

SHA1
0cfc2ffb0a93eec29298f7bbe01f1746a0cd3454

SHA256
65a8e2acfab4bc969379f0941cf10f8d574bae328afaa4b0ed56b2c42050fba5

SHA512
657bfab43523d4c1b7416e7200372108d134582a6634280d434a895492c2ed7a57501a76dcc86919261b91446eedfae54d004605caf792549b743a0f0fc822e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
15f2747b55f99cc020d6a6e4a8e4c6d5

SHA1
cb1bbbf7b3d8ca46423615ba189ac199573b1bb1

SHA256
380eb05cb8b3ffbaffcfab57712533cdd203bc7d053f5eed5f400616da431e33

SHA512
6d1b9c1691467fa1d8032c824c880c8fd70b41377a17e862f4542dc57343391d0dd265d6bc79f0103aec0b84e490794acd9138b2df05080a1f3d7c702535dac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0ff96e81ca80cadf6aa3f5778767db5c

SHA1
85f5a6f70de4e52646b836309142d2c18df417b0

SHA256
a34c16fbc1719cafdba3b2dc5a7d541b1deb6851a8983d2ccdbad6710f82000b

SHA512
965bd7a4a0d56f8ed52ef08e141be13059f3316ad351e1c5f51550b47a293a9ebfeeb89297069fdf89dcef05f839b566cebd5e13c2240536f7b80b33d86c07fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
49aceac3fa37c5bc46dbad0b5d4ebfa9

SHA1
19fcc82e8860893e40af12a75ab63361fec9624a

SHA256
00dab1b508883c56f50dff82fca08fdfb42848ab8914739a11ebedea664bdc00

SHA512
f75446ea122923a7998a6b6cb9cc136c403c064f2f68fb17a8e1671c5ae57079c35950ba9aa9ac0e669252c59df2a18a9fd97771039124e2e4a976e996be248f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c2067727841c0758f531e5f5555832b9

SHA1
116a77c31dee5a445cbc73ce35eb7856d4aa85f3

SHA256
673e6ca4256d071240cdcb851fbf6f3d4a2ebb6e62f76b52920059533aaa703f

SHA512
e67c934fb8b04f38ed78f459f4886d0d9445ea2cb64004fe401c31c094326710a92dd705212d77a184fe68bab6a058c45d8e0f866cfb095f235f66064d4ca033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6420f63db089f204bab43e13ffcdf79b

SHA1
e5ac9f497badff620ffa36cdd10e1dda2ce09513

SHA256
315e429afe4576a8517498dc4428ad243b2dbb7378e99647214a65124b4a4814

SHA512
36d2b4e7ab62db78908a7848e727839ad393304f998ad212698c711b5715a1efe72b5f98a6954188df5881a625352097a4cc1ce0fe9b9a304d184f9f1c4eb505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
69ec10b8621c7f0149479e2d8c48594a

SHA1
aa2b690b4ae449ce9ae9a4516dc7f424ea251aa0

SHA256
76ec7668a12972591fd7a981fd71545bb3bfa1a7c174fea7fa16d7eabb6edf58

SHA512
d65ffc6c5bf6590cf9f70b09183a0b9b5527988f1515cfccd0f07283164a9b58a8ad0f2655e48ba1f8d74fdd983f5dade592bc7d807533d1e37a01927756c6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
22d49d7ebddd0e1f63270132e97a5938

SHA1
35bdc7feed9565d9034e76b5a0732f59e2efb712

SHA256
a922d9c49ee6d4af8cad224252093beff2a262e3610e925085f7ec04f837cf25

SHA512
489cf8d69da2bad2d5690493c9ac568335f00bea21de9d9d6bf794eb5b56dc93b62ada86a2f88a683eaaa8603b88fb3fb7aa6deb7446c2868db576ed48fa573a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e4ef1c9c09edcac335c5fc2bdbfe00a9

SHA1
a2bdf7b06ac9deed1887480f8452598265a09846

SHA256
8a094746d7b30d19fff6c8414ec7f0c91bcaa3580c30a522bb461988a7f73b16

SHA512
5fa3b09faf0f8013194e467ed68bcb520662704226a6d8c8494a49e6e7077229ef009f5a56613362fd26b5ba9ed65aff0de16755450545d1047f53bf46606278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4f6465b6294381606b11f9506abf371c

SHA1
0d72a2eaa55fd729da566f6f405a8ee604394ca6

SHA256
3448e94c822b0b2d4c5c285ad6e00a2a825bb85165685cfb71abaf595c1141bc

SHA512
11d6c2ba1d99c5d40187f23c8a991dcc42561fdffe655a2a3de521460226fcb4a4fd1c4295b4364bbd012c35f2f2fa274f33f6eab27d7003b7e49f678e55e524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
46f968fdc95c8df33b48c73b9188d39f

SHA1
124be3f0ccf9257cbc3e927c0f2c688c7c2482e6

SHA256
0f2a2aa26c679877cef80f0f610bc300b85bd94024e5e1f8974df4e7b31fc5f3

SHA512
63f3035b5b338f35c88428197c64182f9ade59f6bf3b29f5f02700898916863cb493fde899021a2d7dfa75c76194bcc12ebee7af017159692681812fb905393b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
46cc97e71a3325180f884c07fc08db71

SHA1
1233d6f8b6665c5507f52f7627fa85021d89e952

SHA256
e5ef39c67fadfe97704256f9236238ba38da951710935660b83dd1d048a95383

SHA512
1dfa53c8c2ddc08549690480f4329cad033583ce2bd14ab81a39e188f54573453c6e8ca1884711635c7fd9ac983b90f9cfdfa0195cdfa5e00c843648d90934a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
077071d7ad62e24de0ce18528685ba83

SHA1
fe7fd0e1e72815940bce8bafdd578df2ca45d0e4

SHA256
3a67c03f4af381acef77456fd2a6da640a352ec7bb9edcc3687e4bae0f4e7767

SHA512
470334c70bc465d658a4317b8c21f0bad8b92a1ddc96806fa79e53211f29c49bf0d29da1f9b5162635e3a8473c8f5024df584cf56dbc7b74f19fe3a5a7e8940e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f682ba479c84d6ed112b91b9b536dc19

SHA1
95625d8a94c8488e1c41703e83336fa369219188

SHA256
479d18ab6dbcdeffc2a19af9a36209864c9acebe9cdc046f1aec938c43dfa7fd

SHA512
0243020a5f35ab30605b860c5ed886110bd78de041c536f29aeade7ad7642f5f182f2aaa33dec4ef65868df4b28b9ad2f9f1f907183c716145d3420fdeeb46b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f604297ccae5293a2d32ba1f6d04c3e8

SHA1
11b15ae2c235a109f05470365c4926396dfbd0b7

SHA256
910674eb07c83e4dc5cb196ad2557555b9942d05ea2ca717a5da4b6c8fb23a0b

SHA512
b5bae541974c48a4bd195cbd603acfb55a6e3bbcbbac6571347b3a64c646160ceaca012167889a385ad7211cfb6ffc7c2c4e25919684e62dd64929e385770e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f14d34fbb5d5bba5c913d21e2e3d6975

SHA1
7eb1c7259540961536b091c761f21804fc5b6406

SHA256
74d36ee6452dab7856f4c8c9beec8ad2bf4b30bc8ec19b86a92e3cb109291d35

SHA512
978b22b272b998c38529a73119701953a8772385c13ebc0fa4edf2e64665d87edea84ab5f868dd446c7fdc9c66804cfd908e696f8b976eb54bc0fad255630376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
23763b9c284602e85df7483402d10393

SHA1
b835b5ec5cde549dd3b7376b06b449e2ec6ca4d3

SHA256
f3c1c2cc593a9911f5d74a840a333e0241f814f377dd7454ebaec705f2df423c

SHA512
f9a480536f43546e4e6cde68ad2d0f687d4e851677382ea4d5d913651468745e9140e34b086e4232d0d81359171d53678555d5a5aa0d3c20b7ce6eb360388595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a5b5302e8a5eab7ab2cc563312f51a45

SHA1
f333eac14c5daaed3d2768121b643921443e3b98

SHA256
8f33c067ca9d1324ab04761231122f1c8737aeea8a0c05f9947e2df528efbb5c

SHA512
1a157c626ff83c18ec8bcf25692036ca01d57fdd0bab207d0813337bd12b5d8b7dbba5e229b9e9db2fd954fc069e9de53c0e3626bfdab3dd0c08b23287695e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6e5eb153cf17edea1edd32bfc316376f

SHA1
19042bf59c583c1ec629cb585064eae12efbfd5d

SHA256
40476a6ec0f2ab85154da4908be876eb89999e4b309fe9838ab05633f6c684fa

SHA512
fffd0d91b06e61d9c5667163407fa1acf99b9ad5000f837bbf124102fdc4b1b93d97163959d9f6aab05bc6810bcb0b01b1f57a1d629cf7048ad42489ba5a1161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
558099a3c52a52f3600f8e1991ec7bb8

SHA1
3d10e9defead5385ae50b276a56ba9bb22938f65

SHA256
fe8188212cbc8b25f8924ca63a0da87df50780cc814b4e9a493dc60e14ccf1ef

SHA512
9ffdf6fa9714d98e0a0c4fd4ebbaf813c2e9ffb352ea839f566136da3fa046b316dd1664cb0a93f67e2112b48c1412207fe686534628ec19f58e4a5ee6625686

Download Submit