hxxp://noescape[.]exe

max time kernel
1002s
max time network
1037s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-12-2024 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://noescape.exe

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
2308	msedge.exe
2308	msedge.exe
3132	identity_helper.exe
3132	identity_helper.exe
1172	msedge.exe
1172	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1076	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1076	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1444	2308	msedge.exe	77
PID 2308 wrote to memory of 1444	2308	msedge.exe	77
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 3928	2308	msedge.exe	78
PID 2308 wrote to memory of 4368	2308	msedge.exe	79
PID 2308 wrote to memory of 4368	2308	msedge.exe	79
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80
PID 2308 wrote to memory of 740	2308	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://noescape.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc3bd03cb8,0x7ffc3bd03cc8,0x7ffc3bd03cd8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9747947511995624915,16014078648618580233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
27KB

MD5
0dd3e79cbf1483610fa1ac438d0fb607

SHA1
772a1c6a1b4c50a727990cc53a46ec3ac3755ad5

SHA256
2752a0e9312cabae43b766907c81739f1b7b357d4b4410e8bc85734985473df5

SHA512
dc6c0278286c01db86dfe581c968e8c71737ddf1f6dfa4dae01e4f9dca68f330e13ce5abb988176ba42513c6cc3f7b6b003a670778881d69d41bf744b2067b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
65KB

MD5
4e035d4419924345da63c874ba6f534b

SHA1
3d163ded0e3ad03ad25dbc00eab646e66850645a

SHA256
f7e0f5593818363eb354bd153649a8c5e364b55d94596c5493b367271988b132

SHA512
6ca7db61c39c7a7a1b061170f024c5b8adadf402df7c3d722db9b7a1fa4109cb4401944d8661aa9436917d5513390bd4ea4d69124fdd44d770f914b45e056cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
29KB

MD5
cf776b128a74f76a26e70ddd68b46b61

SHA1
24c15fb603cd4028483a5efb1aecb5a78b004a97

SHA256
346cbe6774bf3bf9f3a5aacf287f859103045b0dcd4a32839b00be9f391259fc

SHA512
20751f34d1a3a63e580581d36902928c7780dde70fafa75b87e406965f2dde501b9821cd45c824584d1ece21566eb5fa501d1effdfafff0b2e27ec806bce8f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
36KB

MD5
28afe735c8cf73a6c88376fbd85508c1

SHA1
34fdee7096fb2cb28594ce2d5ff63e41f09c22cd

SHA256
22de5e30581bae29ba36f0a045e9901d996880838619b2af86d16a9a2c055111

SHA512
4b64d34859ebd25287e5d15ad2e622abe7222c38200f34f9e46b6e0673982a6f7384cba8353fcfe55f4ce7370f0ac4fd6126f4acfc5d42c7ddb0ca306dfad250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
86KB

MD5
f8adde4743a52646caa02ebdc986e898

SHA1
8f1ee2fa3993ef280dfa5843907b4c5e7d17de9f

SHA256
099ab8f00960b57a5fa07e52f4d849771ee71a0052db0d8bf39fe81a3128a46a

SHA512
98eed7be7ec368b53e630668c10f12201758d16e98dae94e0a39a4dbb3e9c0e9f89e0b3697abccb5514021fc4b7f4a8da082366ab65c88f76386622aa8181092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
27KB

MD5
1606922bda91f84d58eee8f3c5d11304

SHA1
09b31e75ae0743b9d281a05187596704ceea76b4

SHA256
19ac3b32b788d86432c6988eae817ce1ed23c1361b5cbdffeb58cc8c63f478a9

SHA512
7be91556ccc4ed45186c06b1480339cc611069735fced71c51ccec2a2a34f11a2f0b642d95760e510b6ecb6b5aff1f7fee7b0020f359f689353197a0ff091440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
105KB

MD5
683830d01fe18d96d5b052d843dafb59

SHA1
6f58eb9374e5d4128366592bc88b8f48269f2610

SHA256
28a2b10adeaa7e1936c3b0748d19a331f9989b794d485c12d84e0a16797087ee

SHA512
efdfd54d6d494a78257b29b98e8dfa8cbba3bd9d17cba0fe9434082cd5615a0298372e47f9ac1929fdb656c30b16fbb27853ecf06a10dee6682e920f606c0d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
17KB

MD5
4278a7b3291e3ed561309fab477b0abe

SHA1
3f3741f3c3241ff33e98e483e09e4a84ec9d932f

SHA256
74cdbd546f5458fd5e04c4ed08b57a5cf56af054b8f84c19af0543fadcd6faff

SHA512
0f89451403f51c7b8029cfa8a78834c9007f8fe0f56331f4bd018301a0038fa56dbd37a63aa8a08599d7bb4f1999eb99a9da8626230deca0015b04846bb675d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
30KB

MD5
dbe1ae681ed1aaa48c3079831683e877

SHA1
0d225a4774759fc8a81f08505e3ebf1dac90983a

SHA256
3782680941380cb73759c5f152e71e302f8321907ee7fe1622e7771d30fb5aba

SHA512
069a4fed605c585e02599bc81a88c029a886a9c8dab9adc60da7860c7dd6b3de82b2e23fbd1401226a7a95fcc209bb771267feaf9f71aa763fb3dc2583f37e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
18KB

MD5
6665529d4bfbafcdb7c1aa72e84627d6

SHA1
81d5520ad1585c2b1ba11fce21f33c8777c90ac4

SHA256
2cbb998b241202aed0b15d848ee7b9f2c3a194c112839d393379acbfa5262a0d

SHA512
288e083c9c45d22e113896bf13ada40583cd1dd7a425f41ddb804614e09f945b74da4edce8c91ffc227fd9f509b7a31be4f754139d46b53fa783f31624da96ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
16KB

MD5
994045089128034c34f4233d90d4cd3e

SHA1
78c1cb325459a88700cf760d0819675e0a76e095

SHA256
c9ee2448a569aa78d9771c3dc7b00ce50482ba9b5ec6f3069f14f4f6aa5770c2

SHA512
5a1b5cdc9510969c8fcf9d2f22b5328235a6c9fdfed0ecead560ca46ca52a202c0566d9c73245df04805b978602c25f929016303abbbb8ecf7b4cbe22865f486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
24KB

MD5
3ecd622edb4f98b47697623e33820637

SHA1
4c9691cf646d87b81264f2cba92505b07ecda33f

SHA256
d53dd8eeb39e0a5b1cc1e91c187c93ac9565cbf5b18ec8d48e5bd16bddfdf21f

SHA512
063e9b2c3b53b36af9ba933468b08686481c0974dc350013b8a61cbab315dc9b81be9448591dd2cabcdfdd089a137f8d517fc3278aad6eed73f0946cea86b046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
16KB

MD5
3041f7e3315f03ce23c124b32e5ecf8b

SHA1
107a31132b2a04092f9c6769598a3d2d69abaf12

SHA256
be445d4fa3dae96e1b452e64e6c5c8c4ce1f52423cf93d17c66c01bf3eee89e0

SHA512
3d08a8efe9959687c4c97340d9ef121a145de4d93092d8f866fd22d311ccf3eb204faee9f52e2853e5215852f23dba3bdb12ffacb4671f9121ab8b04f0c947f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
c80bcad194fcf73b0cee600409e8768d

SHA1
8a5365992be90617a2da93bbdba8d73b40f88fd4

SHA256
82916a79bdca89faaaba9833bb431f463a87cddeb11faec73f06facfabf0c893

SHA512
c85ea9dd47217ae4d3c5156af048f155e29cbd54de160797a6d6ad5736eece6ef1fd1b4f509547289461427256403381d01a9ce60ed3652e1a05ffad08c186eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
31KB

MD5
3ed27da40b829eda511d870a5eb8cc52

SHA1
bf9c8ff3ce1f1acb7a28efaca87b57bdea95e231

SHA256
2b27fa2dde6190e2ebe26fed26d4a885005c9a8200938c2c95f9471c3d379d9d

SHA512
b7def924090cd187b366da0636ac1c7b9b9cfbc5ce30bb41bd228faf742f4c6325ba3bf771d622cc69eb0f56342f86c979e5d7efafe332ff18e7cc01c89ad1ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
16KB

MD5
48c80c7c28b5b00a8b4ff94a22b72fe3

SHA1
d57303c2ad2fd5cedc5cb20f264a6965a7819cee

SHA256
6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356

SHA512
c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
29KB

MD5
f85e85276ba5f87111add53684ec3fcb

SHA1
ecaf9aa3c5dd50eca0b83f1fb9effad801336441

SHA256
4b0beec41cb9785652a4a3172a4badbdaa200b5e0b17a7bcc81af25afd9b2432

SHA512
1915a2d4218ee2dbb73c490b1acac722a35f7864b7d488a791c96a16889cd86eee965174b59498295b3491a9783facce5660d719133e9c5fb3b96df47dde7a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
60KB

MD5
5d061b791a1d025de117a04d1a88f391

SHA1
22bf0eac711cb8a1748a6f68b30e0b9e50ea3d69

SHA256
4b285731dab9dd9e7e3b0c694653a6a74bccc16fe34c96d0516bf8960b5689bc

SHA512
1ff46597d3f01cd28aa8539f2bc2871746485de11f5d7995c90014e0b0ad647fb402a54f835db9a90f29c3446171a6870c24f44fb8bbb1f85b88e3ade9e0360e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
928KB

MD5
d041bd9f9dc4e9042866590dd41c4dc6

SHA1
6b61e5f53f83e9c1aa648bb7dfdeae0dc443154d

SHA256
af8a286c8e7a1c2ea7eb7a15c3058618df751419b51aed3cc4bfa5fc9d258cad

SHA512
1379aa44b4a6ba7cff035c6156be5c7e94ad938dc5263dd7f3172315aa860b9a130082b2b03cea64056e2568628fa699e8dbff4e0d6cb6b1161c1959d50ce51b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
16KB

MD5
6c0949d2cafb4b0136e62e83f69aab34

SHA1
e15091c89e7c0e364993d8da0db159f5c143830f

SHA256
201ff0cba3dda97312a40f4c175129cc078beb4a51bf56684713f93cea14485a

SHA512
2d47fdcc9c091b1de9b040d51b4eb0e9ee01b904eafae3d6f284cbe437b955a5a69e5f1705d02efff2ed77c29e876a8a25115bbef26a12fedc3e64a20083ecbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
790KB

MD5
646cd2a078c71617eb8c31eefcfd5ec4

SHA1
c5fbcf48e981941f3e9bb7f6e9adf642f7ff02e2

SHA256
118cc042eba9dad0b5b672f328b19f9014b9548974d08c49c58ff060a6377e80

SHA512
905d2ab5fcd4b87ca37b1665e1b7a57a57abd02c7843f72ad4de60552518c1f1b4a48b1b48840096f98b5a9f199b35fe36a7613ae72e61e9cf8bf2d439041617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0b317ec7dad584a6_0

Filesize
15KB

MD5
5f755eafc327813cfdba18c41bdcfab2

SHA1
992d32409b6b440b6f333f06b7f72cd6efc5e922

SHA256
71286704d3694385368793c20e1939cfd4835e56ad546fe45e34e14d83751371

SHA512
013befa68e81c3af79f8a364412756c92a0814203aa9cfeb1cc3bef5cc1bdb5a77956ba0c885a9da8b4200e581574381bd6705d090bf200d827a89600deb6780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33ccd9b381238735_0

Filesize
676B

MD5
a6a150f5661375ee9ba152b7233b8f5e

SHA1
e494d20211f7d7d4481a8b7b4c407919189dd2f9

SHA256
23aa038e5865408e5c3027394f95c68fae73b17bd473c48b11a45f1d438690ee

SHA512
5978d33a63275885d3fa596188c30117006ab154452b5433e9834717acc6c425bbcf1de80a5742e8c28b6b28164fb3a8284078ebe5d10c53e7b0fa41e5c88cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
c93a3a20abedf53b5379fbe919712cb7

SHA1
5fd7a3a461a65955a790149b9ebd33ff966ecfd1

SHA256
bec774a1aa9ed55779955875941b764f1287c23651e634ebc98327d90c33c039

SHA512
be7a138604e5ade04cac49816780089d7d670a11cc2787bea7c5b324daecc40699952f3500826b0fb9df74c3ce0f05ff2286961cb36971cba5bea08bc8e39074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
083f2bf733d12c69721893631a5ba3a1

SHA1
49195fc3133d64e6d0d24ba4da5b916820b3f6b0

SHA256
44743e698440c88cc91ca6d92e9aa9027687b2e250bbe23df260a837ee8071b0

SHA512
c721dc161659732cb067f0e5387a5af7c1182075ac40e662f5fe6df5e268c11641b0aac253d32f1a013dca622cc8daf0cfef5b032f015f7599b369c2f567c76d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
0bc06c66690d29f8c5007a7d0b3608ca

SHA1
de109cc30ad2598d15ebc498f9aa1ed78a7b7763

SHA256
15e56233402afd7ac0e6bde2370362a32e9c6fbad1ed3b74fce4a0d963e43b36

SHA512
5cb21d9a74ff5139bfacf365e2ba93db06cb5f2e23c165769e137601d2b2941f2a5b033cecb056a11f57a1bfb92ffc86ed2b8522706914f71bde210e56a5483a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a460bfad16d57677ae26a69e66293dee

SHA1
372700d98729accf2836c487775ec68b499574d5

SHA256
e5596b03ca81a2a78097d201b8532b055577052329f849afa328ffe7bd6fc9f9

SHA512
abbc8c8a536b69aa8735d6a82405ccd1361a501f0d10212fcbe1f0cad2a842e0c5e98e4fe435734581b9713f7895925ebcff68cca664375faa671e234fb1bb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4d822950fcb93e8c555ab5d16997c230

SHA1
20ed6cdc10a0252d797f4b1945f4e846a8f2cc9b

SHA256
5d874144bd77cc4fdfdff072516444a00159a7dfd2fef87eb7c6b6b803d09b21

SHA512
ff0e81145be438fea398a5c02c0edb914dc9231f69c87472dd74521f3357ff993232b8bb18457ebac7e2dc61a9d314f43dea202e7656dce9d2f7c7ba260d80b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b3866155bcf71d959b3307f2eb5c5c4b

SHA1
4796527ba7d23a6f18a343955e7c3f8d8011974d

SHA256
233b8cba1a24afc455bd0ffa4040fecf18e05cbb85aff9dec179a98c9fa25e8f

SHA512
c050e88caea938b67b96c6a162be8953a39393e67920aa29a9c47382f38afa167b85184f1aa2bab31130dc22c1e28603ac95ce70f741c2269d6ecfd76cf501a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b41062b84b0a1d7ed6ede68cee42b55b

SHA1
7eb4a79dfdb5828909b56f33f5c14f99b33fbf2d

SHA256
9d1e284a871bd0b3349794244d02ceeadaa9fa1182809ce190d76d59683ec4fc

SHA512
c386baeaaca907cc43824f09349ef6810da1f48886e53755a8a597f0934271e836822adb088165c807632e1491a7ac26fd9a8e05c820838fd5274ccbc378c329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8d5ab0a2b16dcc9d92f76b1e8ed8cf45

SHA1
915cb58d4c35a69bcc356fde403a778114a31bd3

SHA256
f5b35d23ba646153ae4bdd4308db97120ad19be225f2c11c01ae5a36f6ca01d5

SHA512
4259075214ff8f98e1b92971daef0bfb8df918c163c80808cc556a5e080d41147b730a3876bd451243c66fff7a65276ada1c0f7004e2432d61b41f5499e72a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
48f5e7ec35b4b52ce1f774b1f501e381

SHA1
c8441618f4feb99b6d0a20aef9636bf614d46181

SHA256
75317c68302406cbb679f856317da50111e1fc6ba82ec47288d4f85748358d7f

SHA512
a3fbbb01b272bfd78a1febfac01e12ee110cf09a93191853bf0cb5abd4dbc313ab7017d63382444b91d3a514c09ffe4ca26d24914cc8e452d7bcd08d17c0e49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6e5d0118e9e87b3030bd4153cc69fa8b

SHA1
217253c0c20ec87b0239dbcac4a35c066b0e79ea

SHA256
bd18315e6e605dbcf7f58e650568e6349c70de084b1374ea86bc734ced13984f

SHA512
bc7fe1310bb8e0449f57c0ca437e860948b72b154bc5e850131136d45c5a1629deaaf747a36b758fd43ab7431f4c14cf26f75d51c5f9667e7c42cb3f642a2ffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8bcff14f71b394095847861d17e1af2

SHA1
8488cee0d0c2b612b861fa619af6066b68a625d2

SHA256
7dec0887af19a1f03474120f98593ebeaec9bc1f3cc240c0ae965d40d31a5907

SHA512
10b6d3861de0803ece897fa46cd6717ec9a2115e4436488da2aadede0dcd13a75af91f1f14e59cd64eb2214a9065898e8fdcd8903afbab9ff06df15e63ae4a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42a26e847f7f3e49c7e13d8e2a7d1195

SHA1
3a369d0a5a78db1547c0d72af77044e4b540f33c

SHA256
ad7181d22a50d5aad82d4107ca5b4f75b989cc76186f7942ea6fe86cb44a919b

SHA512
215d66184d0ec13ab44ae98073fb4640f938a0ddb02ea62ab25dd92cac52a4cdaaa3f3c852c29d28b442ef871fbd9d1ac09f83bfb73e261f05f0f079627e920b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfa3bf4f01a030fed3afe6ef93479fbb

SHA1
540c51695af3edc1ba25b3f9c37bc3c810621cc5

SHA256
0de13668c849748fc83f5f23e019c4aa137d05b58348248d83073d84895e6b7b

SHA512
581df9740c7cbaa082aa97c54119be1c48f4a5c4a9e82545ce11d90d420c06bd813559f39acf5f55dbbb2907a61c4411743fdfc391445c59176916b7ba587434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c722cb295f91e7027b28ce3c055f67ef

SHA1
36abc9d0e172b2e4030b9b4569411df82194f90a

SHA256
1484dc01320a429968b4be84b12fec8a90f41f9af709485c9236e27cbb376ab2

SHA512
741298d5912b4b5c526b036570d19b81b713ac6b39a06b474da67f5afad910de4a5d36c69d28edaf516f825d741acda5d987f0d70bb5f40f36d631335d6d8952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7fd772284143220ec56ba87af3434742

SHA1
cb526c587cc5095a35eaf67e8a4300220f4cbab6

SHA256
72d8a39eeba109dc5c2423db13b0cbcb0373e76f43378f409d8a371929fc3068

SHA512
5a1fae51a485146e9db95aa6ab29691fe6ee8683f16f185bf18d1ea9da8fbc705bad934c094f3bfbc8fc45546472b2ccceb5e80c39ee4c9c2944dc16625f1b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
035d7adab9757220c4357743b0cd13d9

SHA1
cab2dcabb972ee0bbb0d5e39a61052d8dc7e6e84

SHA256
e3af07b24d7b6128dc54ef94dc21f63b41a2511cc0e13a6b9f0d000a6047b941

SHA512
90416a637b1ca2f00c74a7b3485ea6f01131ed424bd0c70ef50bbcb09273ea1ece1b0740ccdc9fad443dbba71c20ce7c3a217f0f522accdbc497e027f54e6f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
033fa8a25d25b924411dbf65589c90a3

SHA1
7b4187dcb86eb06f6155cfce0d2fffbb230dfb15

SHA256
f8f0fb605b661654e049ac4e4174e6cdbec61af33dbf02ff6f43b72072470584

SHA512
d81d6c93c447b813e8f94ed93de16599dfd289c37943bdacd805415044fcc81e035b9bae96219662a91969e1f668977ecf4165cc0fb018b801046c238f657b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
4KB

MD5
9150f712634ace840b55ce0b77a9c047

SHA1
289b7edad6053fc9ca0365d39d0d9332434017b6

SHA256
ab80616838d8060490f0b7714b0d90a4b568660cd67e50bfb6191b4cca22c277

SHA512
dfc45cc6dcd2735a6985e555e34a319c13d3dac1e80523ceeb94748a633cfbd4552758d9f5b9949c78a8617da5a1d199d5cacd9b089cbfd99bcdee3ad6035308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
2KB

MD5
cf458214b9f901fe7fc3d85a31f6c29d

SHA1
c7d20fd70fba14b45974d0820e61d241d1debd7a

SHA256
82536dbb423bf3670a2213665d18fc4024eadf9dbd1ce3b1469003dce2ee3224

SHA512
4aa1bbf43bcc4acd1cf605cd2899a04f9ebea0bc2dcb9c08bf52cdac720693b016cfcb873499f95f9ac738c3fa2e393a62358c6c98ad2d762ca376d5dd4aba97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

Filesize
3KB

MD5
3ac3cd7aaa8d3ce272af01ba0da6ac1f

SHA1
7f3bdaea58bd1ff1e57f9407b10ac523add76c56

SHA256
1108731c360420a9f1142be46e239065a1998b30ba3ff651763950f8ae893d3f

SHA512
516c7b84e1eb220dd7ba9fa2489749100dde9b7188eb8548e48ce380937250abdaac44602f70518d7314a3f6f6757bb175c3648763f9ec47775b096d5db352c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
21624443020e3541d113eba5ade0c8f5

SHA1
a5085133ff0c31fd4ab3eb9b83686cb29958221d

SHA256
9e6d71a9f9413e7a0e171f4a84a13ec20c5b3f49e888d55800841bae8e0aebf0

SHA512
868d7df943622c4982cf1e247d3b3fe2ab1832530c6c60be2625ec0b33195d1342815d2dabc8a6a18ce22bfb78c4699ef0b092eb4169ff4a37a63869c77d545e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c0ce8.TMP

Filesize
48B

MD5
4fde9b0415c3867a4297a77755a286c2

SHA1
ed5ff064bb96fba57169564e01533016719ecf4b

SHA256
bd5824c9cb1a976c767e6c344110f2ab740057269976ccb115acbdb785f5220f

SHA512
5e3f8b7b6577c23237308befdbf7077c12e04addb9bec82cb9dc31440386f637afed3d9647cc079b5759e881f609d8eb290bddafcbefafbd239038d8b0f6d4e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
6a59a9d95b915d4526deced57232c058

SHA1
308cb1f5c6c088c07f1d34f92aed9adbe01377bc

SHA256
f44fe9befe84c6084808b4d8d3a5ee697cd15b2e5cade4f2ba917dc6af31a5ab

SHA512
435b48faab7f76121f5b0416f9becb8ac21a932758477058e7cdb771f6378812ea5361d7abca56613c653d5e27f055c0697f85a4611860335d913875aff70e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
751fd6c1c15c4d1f787dc9070a73444b

SHA1
8db88b4ad486c01a7aa3bb52260c3ec38b56ba0a

SHA256
8e5ca5a0467d214529a3a99851c145fd32e12a15ad1c9747b3ed1e27f7c7546d

SHA512
33f742e7c4b8e6498c5c57abb41100cdfe2106c3a199575c1f62449dcbc941e55215cce669606f22d4ad7071b55e305c0fc0ce6a428dad9d9d44e71a34f4151c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8aa3c5d00609d3f9d478800c47227b0

SHA1
408d1382249ffb6d44e6731a751bf08f697d8027

SHA256
792a88070a4d7457a98645014fb5f487bfef4f8e6c1d9bf79b289e19404ff2bb

SHA512
ec271225efe7d45ad0c47b36e05555b5c9d0fc60b70c4bd8928e786bb6773a92082f9d27af932ce4858b23725103e79de6674ccc3871ecc40ec014b47ee5665c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c5ea6c4c9aa10c3c100833a41425e40a

SHA1
8be112a91f7d001e523f4caa2fe0c710c27abf71

SHA256
426e52eb13b6b6c14d8465a167c36a3b052642ff9130d31767a817e961b94f2c

SHA512
44c1c5f66e99b7024b388b314626ca6da129be6f883761ea6a82d7538c7512ab2322a2dbdebcaa02576d00795c8718c6cb8eeb3105ef0584a271cb3452876728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c00667b62e0c47852622e14178c3290

SHA1
7012bbcd912ab119f09531d6c9e0d08dcf6fd6b0

SHA256
00af3314d80f4c4e308b7984122552619fc81c2b36bb7fd24666b677f618f3c4

SHA512
e03423c4dc2c5c49e68acf5187a1220a242d18784f517040690e0a8842135d8cf70b7b9b581b1e7c9bfb7c713c942f2733cc8f0121fb20b6c7af82dbb81e9943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f2a1a690a3b61bb51a7a0680f032670b

SHA1
2276afd7006a17b570328536f2f037dcc50e0705

SHA256
f32a59ed1b2db6500153d33b44a85cbc043e6f4e31c3f9a9b22d3df2dc1a7d39

SHA512
2a7ed167393ada1d9c9aea109305ce5dce2081caca69b97b5a53a17434ef177c45db70458708dac9306e5dd123273bfc515c665d4ce569277565d4909f27cca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7a295689dd3c9685c41373c6695a284

SHA1
03bab95a70f215ca80f9134e32a414a34bbba0f6

SHA256
eb6021aa2b56b87719caf3e59104e222c928e2f4019e8194e482d61ccbd65bff

SHA512
5ec5f2a33fb3f99b5b85e5f640c9dc463f20f7c9a10036f35e737f87c81f7c64ee5f4d94f10134485169214fa0fd0b26862a41f6ca056b0b5d4784aba3f4b1b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
32638fa407dd4d9e7db608b735538cfd

SHA1
393e4c28af06076fd3c9af112efe304e38da7754

SHA256
e511f7e5df339d06342d1a83d78f820929dcf0fe509627fe1949079ded4f07c8

SHA512
7da4af4526440f5b01c4c1d44fc215e676aa8813ab154b0d908e357162bd58a7204ae197b5e59b9cefb2aed5900425ce35bc17d760f6e6a33f9e682062a5a6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c1833.TMP

Filesize
537B

MD5
a49029c8202668a57477ecf4642bb0f2

SHA1
ee97f249f3bad4bbb03dc9a27d58157281d77d96

SHA256
5b10fc22d4828941066c9306dd6c954b235aae703c0b1b0acda505415ff06267

SHA512
f1d8ffe222481e9e7acf025d86e2a4841a83548bebc1a1240988055dced19069b53ca7b63a335a77aee2f36790c83cb811679e3dd56ef9d0efea3c4301b6334e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5831e8d-fe7d-4601-bf0d-eea012e1f26d.tmp

Filesize
5KB

MD5
8841da16eb0c02c7d2adb026496aebd3

SHA1
9917ac570c1af2f20a07b24b767392f9d4c892ec

SHA256
2f9e524ff8fbb5dcaba60b34affc803db3cb3049c73d1f281ffe156a86ecdf8a

SHA512
701baecdf18a55be1f80afcae21a7491fca08b9d0a93561affe441fbfdf9f5cd4feac621df8a5be4fb73bfd1085f71443621a4e962d621c473e3d4a3103e8f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
38990bd6068ff33c3ad1562e22c3da5a

SHA1
76912af1e6c9348499aa46bb2567c009b78daa42

SHA256
cfcb580346f592aea2f91f46566c00499486ed570b8cc559e885a0c2f548a751

SHA512
71b0634eb6c66d6856254d58e573394f97bc774e043cb42f4b10f7836cb52b735c3eae57d31615f8edc5e79f1e19e4e1d7c90c1a5fae27cbbb368b068cb4d2d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
9eca3fde58c52a61e3cd32fa19776dcb

SHA1
9c7e792a99c27f873136618723588103bc736ef6

SHA256
8d8abd3e1f63441fec83d8e4cc3754454098e70e8e9d1d2e552269acb8aedd66

SHA512
e0b74f87c01b022ffceea0d40717a7477614e2e1889065cfc31f7dc9873c067993b30866ae151cf1416237a0146fa8bf4df1b63ac14366b649eefd02468c0299

Download Submit