hxxps://toxicspins[.]com

Resubmissions

26-12-2024 16:00

241226-tftewszkgv 3

26-12-2024 15:59

241226-tfbvvazkfs 3

26-12-2024 15:43

241226-s5xm6syrgl 5

26-12-2024 15:26

241226-svcj9aypdl 5

Analysis

max time kernel
898s
max time network
900s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-12-2024 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://toxicspins.com

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3597885618"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31152113"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
4308	msedge.exe
4308	msedge.exe
2140	identity_helper.exe
2140	identity_helper.exe
5028	msedge.exe
5028	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 784	4308	msedge.exe	80
PID 4308 wrote to memory of 784	4308	msedge.exe	80
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 2092	4308	msedge.exe	81
PID 4308 wrote to memory of 860	4308	msedge.exe	82
PID 4308 wrote to memory of 860	4308	msedge.exe	82
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83
PID 4308 wrote to memory of 1072	4308	msedge.exe	83

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://toxicspins.com
1⤵
- Modifies Internet Explorer settings
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd6d5b3cb8,0x7ffd6d5b3cc8,0x7ffd6d5b3cd8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1964 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1648 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3628337186040351342,1563598990892565150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\471ca91f-2bce-4326-8473-f2b3349dad69.tmp

Filesize
7KB

MD5
c6995bf3599828c72d00638524fa8baf

SHA1
6c3c37a112f1599b92597d7ffa207e4a31f43a77

SHA256
5825ef47ed7350690fc440ba69186fe8aea55cdc38b46169e5ba52f630fbaf48

SHA512
ede9857afc4afe1d532ed21dd1ada8a2dfc9beb4ef95ecc59a875250d548e793448343a9713f8f6edd837e4c326c0afc95ff885e11503ba6659b02479ce94564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4752e7df-b20f-44b9-9d1a-edca713da208.tmp

Filesize
1KB

MD5
c87550ab67c87119c268014d024c1e8d

SHA1
a09ac1f405ded8ef60886c83cf016dc5b9e1b624

SHA256
2e8c116b2d719017d2845372bde42599869d3269cb7c86ac9be2b137c7a0ac8d

SHA512
d97dc318eb82a90d6cb049c62ddeaeb2910f5b13cd9fdf14d6fc3941d61ba829d42ca734f7b71606c295a2d8a97d859fdbca8558efd799890c2666005f351ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92d1bc2b-a048-4604-a64c-b473ba29a3e3.tmp

Filesize
1KB

MD5
b526c7654d78c55798df05e6e8ad19ff

SHA1
c6e8b68444c272dbf1807535607712d0662b0cd7

SHA256
94d42f45efa6b3024124d480e21e863953e183382f62033233c4cec8d01364e2

SHA512
766d4e1123fb566b6066e04113ee76d618017fb3980d32d74bb2243d2f6233331d0ef743b7589238c318e705b54d4e4e28742106858613c07f36b02430f22750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
99KB

MD5
086cd4bfc33a9214939a2e914ae428b1

SHA1
8728bac835cdd5d7ad832c6fc259ebd5ac46da88

SHA256
d9bc0191f4511e05a63d02722ea4ce4c953742bd33698120d514d3d862f1308b

SHA512
a6d124d4fd8dcc7ac1a4c8be5475407626565fcc337e43ddf0971c240145fcb4399054b039dbf25fb92eb5b71aba1357e0b3a09ad34ade01e4ae370be80627f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
314KB

MD5
26cfc528bbf3f9545a35f07fd4cc4c83

SHA1
68c18ab5b58b839bca80835b6fece6081e5ecd04

SHA256
813b795e6bab991add6fcc2f9b4e8f938681ab29f21b280f1348b3d1198e8147

SHA512
226ab5af99230fef492ecbbd33c1c4ef9ffdcd8e9c48997455942196c1bf653404313890b7240b781e57e6e456ddb9b921a7031abb85b653b534d3340d4f6a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
32KB

MD5
e7eb40a17f017e7b0651dec263c01ffc

SHA1
26fea5c5c688b2ecf33bb6892c9905159b6d48d9

SHA256
afb8e284cacb33c4d52af3a501a871cf560e4ec94358761743c02f3a21cb1810

SHA512
d7af8ff7adb71dd5ed1620efd913673e108846e02a7775d012825357fa81ab28dde7bce06592256e9f9c2e91ede6a249a7e6bce91a392f6f7ac0b53ac3ca0123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000065

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000068

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
97e45b6d8a544e56d5b5ac6994e0cad6

SHA1
0d9aaefc0b1feefe133a9655b0c73dbb7ebb1781

SHA256
3048b31ecab01ad9683b6ca7ad81f7f4f41d348882cea589f152e3e1f4ec3cae

SHA512
9bb8451fc5ceacc01d8593db0553cea95cb6ab1620977f6b2f84c4408dd1cb252fc790a9f3b8d2366cdde286356f8075ceb86780ce5e9038e68ec2c75b26659e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bea9c0e36769d21c199ff1fff6dd853c

SHA1
7f6c7e9f1bc934918cec6525005913d58a6d5cb6

SHA256
87a770d3cc79ebdca6d5bb5f6f1b1e6d62ed1721184fbb6da29185a006b1571d

SHA512
abb5ddfbe5f9f56c7258c77de47ea064bf35c2a51e68b9783319d6734d8c2b9f46765a9c3808f62159e3478f97f545f735e91229797b4f1a9f6bea697961686a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
29c38d06acba5486b788e25576535d97

SHA1
9eb4a859d178b66c450196324ef6da1f5f184b3e

SHA256
973df05c708de4783874cfd94b4f8373e60a65e38d7437d4f447de66e89476a9

SHA512
211c3d2b2872fad162a3f2eac56b4b9e80e39bd177b886b2c9e68a62987e7bb42197ddc25e62dfe06b879993bed342d1e339a3e4cb1f10418571d32ac3bf9d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c090f1f44d3ce3f0c72d268a4592fe91

SHA1
5d1e8f4318f39cefd693920fd2513bdf4aa65555

SHA256
8848283983c96e919dcb724ebdb90978b239e1804d97cd960eed014375698bb8

SHA512
167e5be403ffcf8d721384424ff59e0198702f9b8c1eaafa696002155aa728d5aeb61d5e306569f5f431e4fd2f3760558ff10809a8134c1ef3b44ef9307e585f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f2078c02e1beff1100aebbc148341f66

SHA1
681e2b3a22ff88dde21f74c9083123a626ca2669

SHA256
9ff8b6bfbfd9197607c212f56a9be6f908c718dc5fe31cb2f8c36eedb0355215

SHA512
4dd87565645bd6ca7c2097615615930d050445508ff82a6a9869ca03b1af24f674f5d6a9856fef51c769e25ee132171c5085644363cf7e801f3617ad85cbbe7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ffece232419ee3afe97c4067fb6c9ea6

SHA1
fb134bda8e2c541bde4da7fef4783c4e15115fdf

SHA256
f343c63f2e7a8f6fa94e9a8d321614d4c8b7c793dee9ad1b95342bbbb678d30e

SHA512
ff84cd4983db75c0b79324bf44c14b2152e9ef4e64ad5917dea8d4487d77201dff63dac663af5313164e16841bcf3ed3a30aa5a9472cee127d4f7beb9d90102f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
507ef6e3507b6492e31dca8690e1a9cd

SHA1
530e53a1da62a9f866a9897926921a20570516a0

SHA256
7a85977b11c5b40ddd7b3a25a2249881c5e459964664cf0a66a7af447eb726b7

SHA512
2ee36fea38ccef74a7c18b37daa53a2d6e63988d947457de90f26544e81c031f0886d29d430fa9650b08a731a51bfe79659b57e9cd014a34b412d06bdb8a2cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
704B

MD5
dbaeb6848556352ee6dd43b18055833a

SHA1
8a2ffa0139e9ad803d3e131a177be1e093660a10

SHA256
926dfd25cb26fb1348ee6e4fd41b40cbd1b8d5228de14e5eab256db813fe47af

SHA512
ecdcaf74adfbf4b8128546e55c86ccb775b671924ca3b9b32e44b599b70cb243f07ba76e2a62a2ede7aa440402ea1c28ebd1341b4e8d64324a88fecc64e02fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
191b192c42c8dafddc66325df2fdd3a4

SHA1
358f1e169c63187d7c213b91b06b9b67b63e8eb2

SHA256
7a6108f0b272c95214922e5de1e1863038e260a2fff593ce095d1cad44e739d1

SHA512
7645309ecbc59a475d09ecbd4e0db3aa9dbf5633d324d35f9d96d1591dfc91bbb6331035142384a6d244445a0020e5f918c0f40bbdc98bcdb63f61a4d6165bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
980B

MD5
ca00d9b243579b1f49cbd4458f769373

SHA1
627110a169f78249f2c9c69976936e4039bb0e76

SHA256
60afbf6af22e7ffa647e5993b0b65f9f247d903c42617ea6434c38815c96f5d7

SHA512
f2a9d1176116ee576dfad256f317a19f74f1cfa8a293b20066bea8074dd263c3937a98cf8a6087e774f84b98d586c4e0448b7dc6eb85538198300185290df901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f02709fda3f3f009a5d1a995fe2f6661

SHA1
53e8653c3c87eba0cfe8567b8daf09650c8c1d71

SHA256
84a24417cd978b3300e92d83fe50243809c9327aa1b8b5911b171d07a156cf83

SHA512
38ee8848b83616040a2684ec6becca2cff139f6ba39e75a3ed7e280aca0e1550467ccfe4aa88c09a331f8059f4607c19fc3758f5171794f83a812e6f68f86415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ff94efbcae67d5f6cc12863a03e1582d

SHA1
e4ee598ff5a43f7f6951c077f6c3c64771786d2e

SHA256
5377cb5a37dd0f5afc4a02877f64a90e13a14b75a40781d2b4c1f7a5781e9808

SHA512
9664981a227beb853e33b1f1b7fc3bdfcddc4a2bd2adf25d259ac2274cce8f4644701acebdf522cf69a651213f275765ecc7200025137a14c24695bae9f1aea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2828ac2b978fdfb72558d58063446e4b

SHA1
2686657fb869638db1170ab2fddf3d025c9ec260

SHA256
caedf6610b206aaa3dd373d359f7605c892305182820de12751017d0ce90a386

SHA512
772eeb94380a04f4d38b0d51075baddc7e29304692235669bc22ec0e2cc71fb46ccd0fbce223342f9e85e02101d24c588cf68e4e54950b8c19c28d37907e5d29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2deb5d3a9aec74bb531e99103cd38f8e

SHA1
f0ea1abd8944d4269c047187637d02589adb2310

SHA256
857f2c89c02d5c86c811149e2cc75aa0706c020254a8a4f3c9be2c8a0047c2df

SHA512
57845f6d465b608528bf470c4ef130d21ed2085d4b6b03a6d1fb8f562515ffc2b42254fc31ab572b4681436ffc4b0fa6ebf534f24433ca1d26a818161e043c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afab72082643fe9dbfeaf1116b70d76c

SHA1
938efedb08c5db49cc0443c3fe9317d4883a5c96

SHA256
db0e6308540fae949685d3daa4daea969ab9bfa4d4c49061b3f082b2be3705af

SHA512
f38edabe81418c447ca37991253d07efaec8f58d2f26694316959c305ea76277dcc923ee8ff1d57194b00406d05aa4625609cf1330cc3f92da4958f659010a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1269a9b6b59662bb542231746a29ca5c

SHA1
31ef33083bd97884596fa5586956051b47dfd6ee

SHA256
fe1756f75fa39ca3eeafbf1e99d650d2873580238c3ac715430d613feccfcf61

SHA512
ea19978d774e4e342cd31428d329906533a2ef8a5ee8f3b577243014da46aecf41c7bed5efc4fd783731211290b9785d9361a72988bdb48fe84c98d1678cc952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b92f399fde392480c704ae6e0ddd1d4

SHA1
e4246961f5d4ae8e157c50c1bcf6742d666e215b

SHA256
9c28948068b7e51ecde7c79c53bd1f0e7e8419fdf42959f333573e705069c9fb

SHA512
24f0b08894e0cc4cb219b72bfa4ecb66e49efe46e8184344f7ee9c77827a30a66f9674f40cd4eb1c0b0fc31d8fd76f0bdc90d2c18643aeb8fc81eaf656e9e0a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7d70bc566c4ce50d6eccb314267f690b

SHA1
c0c48d8d39b177b0cb069519cdd1d210b463b693

SHA256
f87cfa513749a67bf7f03fd71a488ed129d115b3161b3e7a37b668aa411457c8

SHA512
f36f6c6b598d15232c234f5cc3f29958c0088ea2a383ab78e7611aaad81c691060e280278355754d0ab56a6ac2190540e3e2bf842d29179364eaba594361f92a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6344f613b2bfd191dcefeed4f8134d40

SHA1
93c1a19b1a039e6e2ab711ce168e4f3bda95b7f2

SHA256
f0b14742e32e8510d3d47c097642dbb110357f0ac83c82211e5e3ad97b146946

SHA512
62f49ac6aa09c8e5a2b21a32eb6519a275014edcdedd94e58bd6e4d5f99e9b7134f621583acd9db2b03d46530db4f7bd178fee4f118e794628f092b13786f23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
194e6a09e91c891985de7fe59dc3b425

SHA1
8cb47179055983f2d986fc6c5be49990d8f2c250

SHA256
334db75b88a16ddf488bddb88802b76a285c324864b24028c2924512b913b720

SHA512
af12e59cb994507b64d1f94864ea3ec758eec1a3f77f15d4144ee45933319badeeb8593106d1240290d1ea5c7c2b8c69ce6fcc18fd7d5e792da33dbfa7d4b510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
39f237de24a72f1d89de62220d1e1f04

SHA1
1a7c00279f34446140a80c21ebdce73a37850641

SHA256
124c99cf14495dbfa8f9557cbdc0662888e55210cbedb22e0864cd16407df4e2

SHA512
b3b14b6febb46cd52201140524aa6f5af584afd6c6adad2f011deaf4461ec022cc2d5f0063a4d4b9584fa46384943dd11a925532ecc2ecd65564553c2780d5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9220ef4f3567db642df20828007cbe89

SHA1
8b179704e8a3a5497cd07c3953179aef26822bc7

SHA256
3358d89f31c0d9159241826029754c1859abc98f09e0485a9dd2a8abee2f4b17

SHA512
306701adc308aa8f90cca21e6f4d0f0088878e6cc3bc6fe31eeac275c824b9f1b0a069924b2141f114b2ce3db85cc45ad513745b3865df018c705d7e618b8bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6a6e8f5b7d6c78d6e9c789733dc6e84b

SHA1
7ac4f87c29eb133113c1db47cbfb5b434e89a876

SHA256
dfcd2bb56f89bfb0f9060bfc261383e51fcca939a640f18f29f4f0d676ee1b6c

SHA512
a5d7f477df119d3df3861059825426a0fda35dd50c95c5a532ab43ca3b324ffc3b252f236c37b70b90790f383e7e96875d1042c223e82c3e7bc6e69a4714e9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
131abcee3ecc363932ceac661a7c2847

SHA1
23addd8e410cbb15149db52d833e3f193cd86f2c

SHA256
37ed13e1f09832e6bf1707aef263462f4b691afd968a227a8164d0e067f5db65

SHA512
1e3bc7166269116f0b9885e50fbfc6ba093620da1bd35556f0837bddea7b11652fe4991ee1bfa3b286249cefa02050f3685881af901cdf50dcebb9832fc2b9bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed4821ad77038ab0ad6f96684593694d

SHA1
595b675ebde8bbe22054be303547042c86808911

SHA256
46633ee1f0e6de220de1da019ee66fbf7ec574c5249621edcbbe85288b5dcd3c

SHA512
029ae31497f60e7725096a1260bce982608b133179c9233022316f783733255719390600cf2438117fa442647a02ee8025c1e3a177bbb987bf95ab561242bd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f0aac74046d6ae7c42627bf7b255a9bf

SHA1
bbab39620170e5838e44e95d12c945788264ee53

SHA256
e00d5b4eca97fcbdcda3890ce12e239ac47a10eed2d076f521e7611417a13dc8

SHA512
d106e9cb475d4427fd72192df39e8eff13626c3ce59a64b0f1b82e102696a04a811139ea72044fa8421a326030af8b45ff838a92711686b8c6d9ef69a0d94d5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4033a87903d5a63d6a4cb60c2c03861

SHA1
743b0254d372f9e698efbb554ef57d5618743bd1

SHA256
b0905645a01da8f40a658e1fbd39bbd89aa14fd83526745f474ddee9622b2ef0

SHA512
ff9a1e9bee89af7aa62388d5fc016dec89465fdfd3322ef57cab983c83e71d5007cac1cd7dd7eda1b95069c1893d921dc0839026ab3162ce6000223c04218ac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c7a6bdcd70f45ce9dcfdae425cc1277

SHA1
8d22bedb4425c605dd8900df95acf04ee99138a5

SHA256
58fd539fcb9497a58e51fc6259dc2323b07b951ff75f81f893d88fccb2ee77c8

SHA512
9d604764abf48c738a51a308f6426b193dd34da46c34731b39b75b967f4c2fc553a3997b608525b04c49b9fe3ed3fb21e26d0735361f413e6a55dfe5d6af504f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8ee444e8c3943d1853b274872daf9625

SHA1
6d482635d4288dc5176d7e63e95837e132708c13

SHA256
3ff798a0ad2c1a66c0755ed21a2b792844fdfc94687f98c8bae275613f36c492

SHA512
42c05ab9c1a009d82d7d4710893ce87437c206229880c15bf322d251cc07273f33f55ee3f58b72011d0dc8bb51f6adc135599a03234f13fb5d0b44b6679fdae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6f74cc87fb59242e32c4a51e60f5cd8

SHA1
7c0857987e26613c30b0776b8178cb27ca86bbdd

SHA256
2598e623af0f4142deb71e7f56b906979a368569ad9530de68670b349439d037

SHA512
92c5e4cd3577bc5fdae747d993e0633ad6c6b7890d65d79910f0d483ce117f857494afa4d650ccb3e3c0b8ade3a6fb639d2de4f6657d4a22422028f13e0572df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
937f1a44d941952a59959bc4e285a3c4

SHA1
ab24d6087f4c263649a59350e85be50cd5cb0753

SHA256
249e42d7ffe63470443359b1882fb37fbcdd238c458f84c2778468008cf3c152

SHA512
f4a2b5f8820c05716e66cd081084e292cdd419d0e60f36e6f40e1651d143f66b72f170c179dbe2aed8ee25e3f08125ad22b08a8c759fef45ed2249624307947a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58003a.TMP

Filesize
872B

MD5
d6d59ee1feb7b870a96b14958dbb320c

SHA1
8326c7e51c37c52b7931c70be93e1d13b87eb160

SHA256
5fec5d40abb61e02b66cce61e247313787a0e7a7450bef81e1d0cf5241714de3

SHA512
6e0916b5e0f35c49b292895f452235b15aaf00317ccda03d34893f555f01bbe15a0bdb38244bee44e667193ee05789d931684ab6545f51f89eaf92091bf03d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c65873f0-e6a4-481c-b551-384734263c09.tmp

Filesize
10KB

MD5
d46a138da1fa14e7f71e735554bf1b38

SHA1
95b685e039c2a0e59375615f5d2160b797273d7e

SHA256
6384d61b7f19af80b98cab27fb0b3021111316c7641a4904ae746c5e419493d7

SHA512
b466c460111ef2d716e764bf5f8a9a40fa6d43a1ce4379410ad96eaa0db85cba5d6682934f30385be05c488cdf99246de9e029b4568fc0d0f04a98956a0c2002

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
b7443e89f0cb29d51ee6a257750e54d2

SHA1
84127eebf275e781d5276af6fc4d09c5a6bfb7b9

SHA256
8226877d6ab2e4834aea6bc71bd9865b28d0bd1ec2e8b4c23b8acf0301c56f26

SHA512
446cfe25d82f3bbf7badd324cae691ad62e13bd7469e415f47b9141bddf30679219c672937f4f6768796c2936c3b9c557fabbda1fb51c5edbb7c1964bffa17be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit