463a64d183f90599991de74c1b48330ad796fcd7aa733ac1a9be131eaa80618c

Resubmissions

01/01/2025, 19:28

250101-x6q91asmen 7

01/01/2025, 19:10

250101-xvtwrayphx 8

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2025, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pepe.jpg
Size

9KB
MD5

75494425adf92da992dc799a556f65ea
SHA1

03a82524d97f766d2cd7305e45566e560197a512
SHA256

463a64d183f90599991de74c1b48330ad796fcd7aa733ac1a9be131eaa80618c
SHA512

20ddaec720ba304b644a010bfb3676fe13f64d9e7099e333051e5db43e2563d983fab29565e5f7902b017217ff450f5ce9ad68f2fa155ec780bbdd2914a117f7
SSDEEP

192:PT5eLK+PqoNaK7HrML4vT4ZkGorW+1ewk108rCqbWOqQlW:PlCBbw2xrWkb8rCqKqW

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: currency-file@1
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
250	camo.githubusercontent.com
251	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
2300	msedge.exe
2300	msedge.exe
1520	identity_helper.exe
1520	identity_helper.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5780	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5780	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2428	2300	msedge.exe	89
PID 2300 wrote to memory of 2428	2300	msedge.exe	89
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 3012	2300	msedge.exe	90
PID 2300 wrote to memory of 624	2300	msedge.exe	91
PID 2300 wrote to memory of 624	2300	msedge.exe	91
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92
PID 2300 wrote to memory of 3588	2300	msedge.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\pepe.jpg
1⤵
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa726446f8,0x7ffa72644708,0x7ffa72644718
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8603889580038774820,6143780681601962868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:880

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x340 0x31c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\053426a9-2499-48fa-8351-bc2f1efad347.tmp

Filesize
9KB

MD5
ad4dd5290718b2c333728312fa50977c

SHA1
3801c4be96ecf9ba56e60e9577a963726282c0df

SHA256
025d513bd491a2f5a1811d0e92240e96b10927eb262b10a07c03960709ca03bf

SHA512
c07527d2c295806bc0d41d1d03fe2f14ff27528c0c49720dbaf236cc751e892e3c7886db59d73342ec61f52e952cf454b6a17c433f1050582246290e52ba9ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
84KB

MD5
270246efa701843deec912f5c2bf159d

SHA1
ee04d419b11468651b49b5f5e7175d39a283bc7d

SHA256
e7d59c84a49c4802e81df7e159e552626b8d2b5473b4aa01f1e137720b99f2f5

SHA512
d6e3802f1dbdf12284217bf526a1939af12152218ef6a72cf6b001aa41efa8cf0e8021221000c04fac9d8841f4f73fe4212e1c8b5396d1199c84fef3ca6fe7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d40a9a6741eb3b41c80e41f0beaca3e5

SHA1
d703bc5feaa853e4130e846d7eb8483c7b08d1ae

SHA256
99aee1160d411bd34e071776ce4124a037e46dcf3add5e3984d36626a37a3d43

SHA512
58f1adfa49886cf9fa8dac1278574c261d72fb1bd9b0546ae4225acf282f70f185fe78b8a551b190917955b7c3931271cb8e22b931c598e412395e7f69318ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
271011abeb53bb73302c2b4c80bcb930

SHA1
12c31fb442016bac3a78f91d9a05fb2db55fe021

SHA256
22998b07282eba245137df13605b7aed4405f1390a1622497a9f658ef9676ee1

SHA512
4e10909370437e0a2f302824f2732ae88ae2da7a8350b395ed8bf0b951282893efadea1bc3ad6bc8be29c65e5cf54111b7dd5ff091eb74e4a3279a037c0767b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
58649044945b4c6ca9986c10a3706165

SHA1
b3fe459832c8c4f7e74dad03b9cce0458890049d

SHA256
765ab60aa85c1b0b143bfc2bae018318536de1c13b0da5681988a5092e6f1783

SHA512
1a7a874131d82831e7a0cac5d76217d65169967b96fcce22f36ec7992b20bc3b9c742845979911547c895ba5e6356d60ae2b8b09aafceeab556583cf2fdd9066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
0b9d20a1e7f9ab0934915c50db90fe86

SHA1
46d0c910a49eb369df67a925bfd07245eaa94081

SHA256
8712eb268302b6ce685bd09cd2a4f1551a4b86a47e6432caa0062b0b2d8f759d

SHA512
6ee012edba2cec5b465e16823031c7a3efcfe4322f7d2588bf98efd74030462170d606db883e89a74fd26994fcc2f0acf389c51e85e5de4e5c79244a0a9a37c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
72114d5222c0888538ca2f2dcfcedbd3

SHA1
c587f23467d4cca7b81b90a384d3d5a9dbe8b3c2

SHA256
5e41481582330c0b79249cf65ebf7be948fba2f61fbc5b5fbef23e465521c09b

SHA512
7fec3692b3a78b4fe6962bf79fddb69b8a83e280240e2371607a5306374cc9b407d301134cb11feed01dd56ad1564cbded1db64293f18b9f18ccd8ba5cac5456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
83ba3e38702c4e0139d17b12d0e7a625

SHA1
6944480730b05cba4bdfe09bed4ff3b4911d5d08

SHA256
17606b1c40d30dd45ad87e0ad02999a7828a5d9cb8f27b2f8064cfcc051a9d9b

SHA512
69cc601993a3d2f95d4fad27d729273df56f267f39b801f25ef932b6d57e69379c3d4df2da41534a6d7277439f3bb452515e5a0b9c5b77e0765851b92c255858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
00aa31d46420a0a66894c2399216b651

SHA1
ef69b40f0034cfcd0bf7a1db1ebed3b4d063635a

SHA256
0b2b0e239471e42b510e022319b937bf01f2cf8d55cfde6f9659b4427ca528d6

SHA512
2225830f02ecdb8dc5cbd9cecdde43c219428b8f5bb87ad4e668e55afe65a803eae7f3e8249ef6415e026cde522f0a9f214a258210f4dfd5954bc32206e6e7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
b0f509ea28dfa0954c5c86a81b1a2984

SHA1
f2a780e5d4284a88ee236eec236f135405b0dbf6

SHA256
0bdbdfb2e990e855ef9f77b68c0eab519252b2fe09f7ebf057d41bdfc9f0c12e

SHA512
c962a4cf637ab209ca6001442df5913446118ba222d6e5336429bc6f4f8a0825058fb30bc50f2c71881da0344577284624a47e6920c120a50e8093cb9f404185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
2d87dd3dcd8b718767713eebbd99d37b

SHA1
51d02347de200dd1eab073a87e1b09136d70466c

SHA256
29882f7b22da7aa0c2ca97596e1eff22f5e63855d2d1ae9f9fee2aa24b0df3db

SHA512
762e8274639c5039ba0343e135a7254ef20d69b6f5b420ba6309d0424ba11c152d2065202e940e84ae4ccaddcc0b27b339ea612df39b5535cf440f8dab971892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
2f206a3ccdf19f02ec8d2e2e38d39596

SHA1
dc4d9ba6eab3463e8f3b2697a4d3d0dcc7428db1

SHA256
3b0955dc68d4ecbeeb199d16242ad488da7e8d07de424729009f5b1fa54517be

SHA512
d0905ec0b212d2eb009fd325c8a66c878a123416460a713d8f8ce35d5d93358417c15114a4e0714a902d16234a05dc504d0cfbf4263a6356a364168b17481873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
93dea95081faeb7e2c8a9892f4197f81

SHA1
9fedeeaa311a9baf995f94208927748659cdff1f

SHA256
ebfbd6377a14b80a1d7074ab08a728fab76aa7031428becaa041cbe6d54d2823

SHA512
13feb01842357d8cb3459cd532d9cad99dfb41ad83c83dab6bc8b9689989f6fb8bf1e33f57d3c5ef94ded0ba21396173e1451e4a50bdbdb95431883f1ac4678b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
33e4ea42c3cbf774c93124b73c863fc9

SHA1
0ee0542a1fc0acdf57b1b948faf4da21111c0086

SHA256
fbadfd9088fe94a93e2562505e8e6eca56c236fd52ef511a492fd3fbaa46002c

SHA512
5124b177426424f1507767f38485cd0e7c31bfb87df1ff21ffa8ee15494e7dc04c802a0c81c46381678c3e961f21f705a66786a8392397ad40aa5f39106e0409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcbbe4f86cec01f7f4ca5f38ee103cb0

SHA1
e0a9061c690ecd47d7d5701cb262adf802af4187

SHA256
7cd0015b48a0e266498335977c96d511b1079ea4d0ca9b1c36cc9885aaf78154

SHA512
b4bc1e938918753de696e3a91c3573e43785f168667cd79db55c95f3d0285d1c510199414ff87bfcde5f63b76cb7dad2f8f2583d82007f81db234ea4b50a94e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
8c8ecb8e75937dd29e902baf8985ec3e

SHA1
8e086d2a57d7219b977c1a2be34f55faa87f0110

SHA256
34ec14e10679019532f02ecfc2b67ee25377e3c251c6cc61476eb4ebee906c3e

SHA512
f712c89f727e247831336b3dfb585d8ab8a5aaf0f871d6844c2e9e5a6d95f1212591502b5e84326aa3435e04646657166a7d5c8b8f789506c3d3b316263e849e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c3cb683798f4330ecd7ceb28f13f860

SHA1
50dd0cc879dfc7522e3cdec13c0e31da8b0267e1

SHA256
230865562028dce40e1c726f6979b4a8bc5b040a9c8310ff4d2aa6dc2c15dd94

SHA512
7eedcd35776a8ea308d2a0a4d89ed2b4cdea660ef34402f9b123ca345b7a3bea3f40d02b424c5b83b3331e80af16cc74208608a48519c99c912431f4e3ff40ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
2d5bf1da0547193bff6e21c6b91db2b1

SHA1
5a9aa9c8ad49b178e4feaa39f87e801e359db751

SHA256
8837abe17c678eba89f21281b4455348380095fa236f553668921da16b17882f

SHA512
324413c5299a0882e61878c0086660b6f89a4fc0c153b5ab426b5b57d42ec02199a364cab7346c748c2ea2a3a79802372a8bd195dbd4f8cdf2b6c6bb45fc0d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
60e1b3b22dcc30a488c53a5abb8f9bea

SHA1
fd6b2d98f90adf525623d11347b12a0543b3a044

SHA256
e54c620e9bccec4dfdba3ec6c202ec68537703f1b547c95f3da2bb138af33466

SHA512
73f58b6f93a07fe5ee0f23dc2f2d6bcdd88c057476f046b9d2317e7f399840b6e4466ad7148eef96c342a4196093de2b0c6e3d78d9e57ede920d4372a117de8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
88df2a444d255c037b8bf2064101b914

SHA1
4da3f5f9e2219d18c9fbba81cb0577c260b6a9b4

SHA256
6dbe04a2cb8b9335a2328251aed4c9401b2ad7110e90f3b04f8bf4676438ef03

SHA512
5cfddb3821825c376e0cd1edc9c1bc8fd75d497728f6f9c9f64358f87c9887fff74ab7eadd7991ebb79cde1af7275b8aade867704e04264884e8b67bd3df2c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0e79917f61c52f77e6366c96f630aaa0

SHA1
12384384f00096a021af55aa17513655d484a288

SHA256
86eab9dc477bde2c1aa5990390e8f56d0beb746dce88102a938b2fbe5c2cd567

SHA512
49958db902e8eef3155d8004a2c426c319ca7e096c800b772d94128b18e68e3b81cd806e01321dd5c14b45891a290bfe9b8b08ded18da2493216e3665a13e0f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
037e596636c1a32247fa201b07bfa10c

SHA1
5affcc1d6c4680eac483cbd7d124d4a0984e6562

SHA256
fe6f0fee11a9c522427932565b0e7b473044787362938aeedecb4b1b59c54fb8

SHA512
273bc11c49031f0bf0f8d64bdd1065affc758b7376244c8a908d3d9b94de9e4d5a1f305e4e8aa0f5efeb34625166540efa095ba5705f59af03d3dd4ab1823a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6f808e7cfec2da67468f4d997e23ec83

SHA1
4cd00adfbb876408caab6b7b1847e810587a3ca4

SHA256
23ab75fb6a927778f630ce1ca5ba3d891260c8b9a41558cff929a5bd29311b8b

SHA512
9a36a66c05198516e8f3349e286f9552885696dd97ee96474112cc0eef80a5b6a01c1e01f885811150efe4a9cdf0020bc8287d1dbfa6ad285102d0c62a4cdb17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
530d9e1f85ddc0fcd9c52ce47589c795

SHA1
ef4bbbd56556aed6a266a04a5f077586e4a3cdf7

SHA256
8954a93edf512da120fb0a13ed2903069e60856d4b91a7399cf8d401f693439e

SHA512
c422dbaf955d4c9a7bc1d9b9503a8c0e505f0b983367b2fdc161fda7b7c2fe4afbde41d77cc773f9cc39b6159b54be76cf11a7cac19da8ef85d5312d10f843f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
021d7f435632845361b28bf4b14b9d38

SHA1
1a52d33d4e599d0904c244b50dd69b3e11a76ff4

SHA256
c7ea3ef9374f5ca23836c386d9cdb70ca5f8423922be81419375f4844fb3003e

SHA512
c4daa8ed2a7ac0c687253cbe3a1130172fb6fe363c41a41cd4617d29a136266d8f907cc543d782362b735adc498aa4fab45fc05c51a65e8c461be7c694681257

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
91bc92f80eebac3c0815e0253847b73e

SHA1
73eb7eece8e3456acdc4acf0bc27ef8cc4cfdad5

SHA256
d58f1dbbb004c65d27b96489e1d1f295f9ff72455f3e73157723151562a99155

SHA512
8cbb6eea93900deab5837d5405c34e7c5dfc8aca084fb80fedfbe866ee23a77a48bb67b69b1537dede732c9c20378a99c283b9e4788aebbd68303a79187a082f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
cd523671377696611434723f19a1094c

SHA1
be8082cdab5fcc6d3fcd5cb39770928f50c5147c

SHA256
d7dc69498dcaaaa556e2699ac7465e0b8e3e30d2910592fa42a095104125696c

SHA512
dccd98253fa82344b29c7e33f241f61af46c18a4ff2ee32d8c9d1ecc61d6b9146cc3d9be638b492b14c318d336895b7602973d48548a1e51b86b7ccee332146e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
5e8b1de4d83562e6d90acf5b905acccb

SHA1
1264f7c01f66daaf02653b03c96ccbe8d74db6bb

SHA256
8c6c4423442e3231da2993b2f3d253627068676cfad00977231e68ed08174a92

SHA512
b8316bc7ff8343924b1c987603236d663abfd92669b4fcc1a4f6823b61709a370159400f2b46ee6b4ad362f44652ad4b3dbadf86431ff6e79fc2a7f863cb5468

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
54604628c84edbc02129a944f4c326e8

SHA1
92380541a67ce210714c6a4ed92d5caa19b4f5c2

SHA256
7ec8deee72426c8b899bbf1d35a7b5a48e92b74e8a206dcedea0488d812aa001

SHA512
36fb535e83e83011bbe21e2375881342dc187f408849949f31b5650189cf10d81ab09d7b973963e44cd31c3ea5a9142cfc7870da06130f177a0e4d1f1d979fae

Download Submit