hxxps://fishandprawnhut[.]com/ilzwepmncakdhi

Analysis

max time kernel
197s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://fishandprawnhut.com/ilzwepmncakdhi

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000092e6c6e09718db01e3dee20ba418db01c1656089b753db0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
2148	msedge.exe
2148	msedge.exe
2348	identity_helper.exe
2348	identity_helper.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 4736	2148	msedge.exe	82
PID 2148 wrote to memory of 4736	2148	msedge.exe	82
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 3288	2148	msedge.exe	83
PID 2148 wrote to memory of 4868	2148	msedge.exe	84
PID 2148 wrote to memory of 4868	2148	msedge.exe	84
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85
PID 2148 wrote to memory of 712	2148	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://fishandprawnhut.com/ilzwepmncakdhi
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac1d46f8,0x7ffdac1d4708,0x7ffdac1d4718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2096,7876092460666805448,2254240371634282965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1256 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a153d9f-20ba-4c7d-8974-5bfd4a73a468.tmp

Filesize
873B

MD5
48d262d24f9cd942a8168593e3b246dc

SHA1
7583664be12d5094ad6eb1e34605f4cf49cf3c81

SHA256
d82dcccaeb09d8fe6686f1238dc638f1542181b37827a58b3bb5828b00332dd4

SHA512
b547f40a61feaa412422019b5babeb823d8c1dc2adaf8e1590b05d0b96128d26688ccdbb413ef8c90c0f6c0ed829ccc4715be23e4e509f3c566eb24e40643c0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
177a8dc1ddd7e787e4ce97bfcf98bcaf

SHA1
6d00749bb396cccfd0e1985c019bac737ecd992f

SHA256
fd56e2b8fda3ac0622a3ee9dfb0b6d3d62a9ca1dac3eae8a0ec7f7f626cede7a

SHA512
7833068c3ae08a75df6f27cf874c1a83c0c8d0b22af6f1e09d89d0f99e22b34993edd19db09ce0deca7d5b8485ce93fbf6afe54429d507060faaeaa540f9b336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c54d25d7b54e3578f1cd6d03955c0f72

SHA1
0d09e132474fbc05cc55053598c38e2372b95642

SHA256
7140470531eba28a8fd5f382ae413579cee0bb695ef947ff0572eede4c73c66e

SHA512
aeddf850f844393013779acb0b6b027b8b226e468aa280be611c23762fcbd52663996095f471a451cb38d89538c249d1f926fd40c5eb877bf43f40871739a3f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6417684a49c689887b766ada17f6ffc9

SHA1
e11382ef2d40a83cb157166cc1da1e6590c757d6

SHA256
94b36e8710a376e4e005d36defe5ef1a40090b708410980080601584181d4181

SHA512
a5a5bbfa8d3cbd253a7723828c9fe661aa89ea2129bddeb65760e45ea1b88a36644825d7a416e451b9f10c412a8e49cccad02939ca48c731cc50bec101a46ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5f30aec7ac7cb3ab6a8630c5c3376d38

SHA1
72db39a7836c69886c671c16500b9bde4b2fb09e

SHA256
09c815927782f198daa62179e3dfed71d8886f20618c4de616aef421650872cd

SHA512
f11c2f71df75bf5a0d69052213baa22e42a085e2901acdf06a56f92d4593ed74db3d57d713f526a63a503c2b83409617419aa1b141e2827867e4a2ccabb4f439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ced46c7c69cf1158789fa3ed4cf5f0a

SHA1
bd92700bef771c19428a869c3dd069f559e2115f

SHA256
df71dd7ca30812e0c964ab87e5436dbd4b702370613a9000ede86039f24a7693

SHA512
ddc097bd76941632a98e2e805c996956c6c1339cc473aa12b95202bedb2184c96163eb15a4ba04972cb3b848993ec48bca5105cbb6b10928108383cdbf514a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7122e446266480de86f11ea44e850a82

SHA1
f8d82f7d907f45a220079e6ef408038ef81163fa

SHA256
df9b9277ce03d9dd1fd307045800a5cea138c213c1a82babfdaaf119550647ed

SHA512
fd0788dc8a1dd72fa67b062debb1d397b5e2a0071038cd08e1f36215b40190fbc2c2d9bd3474405087b119c104876074a8d80240e8f97ec9c3bddcf6b61e839c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf10cac5a155c202eb2fa21c922aad6c

SHA1
0e03383f4de8c1dbb535809bfa5641cba2d37593

SHA256
9a0edb37a75a19411a4e587dffa33e5563d54a7148e4866075926397f82601a5

SHA512
80c68c107767103af47104e8a24dc615a51f88bbdf9814348a1d3ddef5e874f4b5fd643c66bbaabc41b90e40fa01b41f1dcc04e0e204e85cb31521b88ca007ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
cca901beaa9f281d95ba0980060b3009

SHA1
ed61d598be5130d0bdf5118a0faf3c979c7a032d

SHA256
46516d0255a0c5faa63a255df8a165d4777e3843b485e0ed405f1f60b6a90e75

SHA512
5e9751ded1ca409ac1a578ca8f3cb82143c044c9beebb11c08b2854b098d4ff285522c5f9d1c04317a6c055fdcd46bbfc74a62f3486e3f973315860498fb01c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
1bb0631be767763c555a99d3194f912d

SHA1
70634a99deea0ad31fed0a7187ff2507e764ea5b

SHA256
c2862d4cbaccabfb373b948f84216a1696cb1670ebcb59865d8730ad8d9cdf9d

SHA512
75f470fbf58b017b8d882f82d5dbc3602c91eb8e6f915145ff1de84a642c368ce1037cbb8f1d4d00a943ded0047024668821ab6bf73f7f2f86129f60d0a3d6b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
3545321e60a0fc104f12e4b759552b9b

SHA1
bafdcc673e2d918f4edcc1d3db644a4452c9ced0

SHA256
1508810e0312cb3742741305ffb2cea536169827721331a300690d65f00fa8a3

SHA512
1afa268ff61c3286c8bd5765902d4ea2777842c91c38c52b62f384860d7b7e417fab5191997269f3a3b5fa376735ddb1c5443cd301ed20674ea1a41ccba05088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
bef4560f6838a4e783ef1cbf2fd2d7e2

SHA1
d0e0e0c600b985c0c9af87faa0fcaef78170f3b3

SHA256
82d46eb025e4ef378898b61d52b86c25e74a4bac80bbe4c7b901c3102f0a4d6f

SHA512
54252285ce4d312b24d06406ccf3227c2838dd316cd8d6dcd4c86fcde6d627f793db69dcd95d867718af252cf218ecbd2578115d733c33a3f4256814665580bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
4920bdea278e74bd084212a044833354

SHA1
b10a02f2bd833565b896189d8bfab0c71eef3463

SHA256
6935996cceff4293cf83532473a8a7a338a57b34f771a29abb993de794caa0bd

SHA512
e19d2da536c27cfb40d8a6d679aa1b94bd3e86446c1df351a77363d54ad4a9ad0d552e1c5413e5218000d0f7eec008b7f8dcce94476ed4c698db7620dd1bb438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
208e0ceebef5d57c67f5eb498cdba6f1

SHA1
ed8b1461e632b04266f4de024e7d9577c8d9eb99

SHA256
da21d6e8c4eee81aa72af6d8a4c4ced5bfcdf7fb7e35cbe5e272b483cfb5f414

SHA512
3fd9c5e2911ab56e3b34fc019088dd7be3ded98d4c86d57172a3000effcc06febe57df38bccbc80be53e27bd59c807656b0c506c04943b6c5101cb676bcf3f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
8328df4da6770fa912448fe58d7a3e95

SHA1
81fb003015cf19a2aff8aefbff8898ebe51a5006

SHA256
9c78eabeed250feb6fe76f200e298d70b9f5adbf4ae52b3436567ddc4bbde63e

SHA512
2361b54bfebc1752eba45aa32e2be0d5ebf2add3762c0b0d2c4be6e5182633966b087d15e8e8b234625851760b2cac7b8b2c5b19e05642169813bb12f952b178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
103d6ef7510c2a6d5ef980fe96c7b18a

SHA1
4998fbf9b7d8b8e90658ced2fa87b70e385b64bb

SHA256
f8293a52b8361b87317727eebf6e3625fcabac52d334a8e7d26fc99cd5d82309

SHA512
668f260d97a1861ecf9b9eacbb0de9a713900f61811a075861acc0430b34eedd65bd051b48a38675d3a0bba1052346020ea98a20f920c603366b0b60bc32e84a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
7cc78b0584a58201e3052fa9888b36e2

SHA1
8dd05409a5c8a2ba81ed154ec31b4572c824f18a

SHA256
7ca62a471d6cbaae60c7fe34009615cf4a1fbb99bece55bf926e47eeee805473

SHA512
50ff65e5a72733b30423500beb63b5f37e17fa92c5febca24b3602530f8f79fc9094ffb8ce9810a193c9e21392135f9cd004f2ad307a0dcebd97b6c7e7a1c26f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
df85a8ee94d3e50ad0a1be3dab986b86

SHA1
c35148d219c5d62eaf95aedf8c165e6f2d587b85

SHA256
50b4b38d6e5cc52d5ac6f604e883e2336e59b50b49a6b9b995b3b0c58e78143c

SHA512
0ebac29b3fe1bc23e04f097ddbf43ec316984277d7cdb21be3a75676c698eb92bf8a5eb86eeb54ca921e443b88baee043a3074625bcffc65a5880fb9b3fec378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
5f985e86aa8dc73979022fb290277859

SHA1
0c5875bca74a4f5a047b1568b5aa4abf254a0645

SHA256
c85eb9b3bca536c40e87a5467ad81a533d74db920e1a24f008e10e77ae72db25

SHA512
3f5a9e06a7959660fad07125892b5491f0f6bb320f07eaa352a24a8a651e5f2100ba5922b1072fdfd009a39610eb7c36f9a3b6fd18d3c87dcb267c019ea553c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5893de.TMP

Filesize
539B

MD5
4a1b9906d6bcee384b6e3c6c5fc5c531

SHA1
8aebc0aa7d58cecb3374ccdad897566a38a39a74

SHA256
f8a89a2174be9dbc2f7b80312c7de94a7a312b1f0f68e79d7b2d8c8e6cfcb307

SHA512
dcdccb42f0bbb81f11a3fe386ea734bc317e0fa3261c5e8ad9176bfb534561bc88f7f99901760d6d6311c92072719e2abe3bed9bd5ed0622b6965d0bca687365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f51941d244ece1535e767ad621cee1c6

SHA1
edf5957b4443e197e0968c660906b0887eed83c2

SHA256
8413ceba33f22fdb84e05ef9c9b6044c9d03efde81d60fcfff8f365a7ab1f7f9

SHA512
738513d167ff2a8fc1416059f2712e546edd5c6b9e049d23cad62f8e8f3aef6398f23ec27b913dfa36bf17cab0c114421932322d92fe900a803a9cae40bbe855

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit