hxxp://steamcommunity[.]com/gift-card/pay/50

Analysis

max time kernel
178s
max time network
184s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
29-01-2025 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunity.com/gift-card/pay/50

Score

6^/10

steam discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
223	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	3276	msedge.exe

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
55	3276	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
4320	msedge.exe
4320	msedge.exe
4692	msedge.exe
4692	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1944	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 2740	4320	msedge.exe	77
PID 4320 wrote to memory of 2740	4320	msedge.exe	77
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 2448	4320	msedge.exe	78
PID 4320 wrote to memory of 3276	4320	msedge.exe	79
PID 4320 wrote to memory of 3276	4320	msedge.exe	79
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80
PID 4320 wrote to memory of 720	4320	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://steamcommunity.com/gift-card/pay/50
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdd9af3cb8,0x7ffdd9af3cc8,0x7ffdd9af3cd8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - Detected potential entity reuse from brand STEAM.
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8716 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9288 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13125827698701073360,10178673324725335306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:5160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
f21a1fb70e9f143039ca7a959a0d8f44

SHA1
b583b2bcb2807278ddddb098a97a44c90d8ba4fd

SHA256
188d552f8eca4bcdc981c418e06e0ffa4714a0b52a1ba46e487b679006438392

SHA512
e286770b729064634b682657cb537ed2bc26fba8d081d7c7333ad4510430434360a2471aa15ff2756a61bacc0173e011fbddedeb4b552fd82d068d91abf3886e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
99KB

MD5
9223bf9cc1ae88082b1211a95c9d4c78

SHA1
d4e899817218dff304fdc3acbc3bca421616ecc1

SHA256
ab75c97d0f347abe5ce7a0b6633981b417be558d856f566cff51651f5ebb00af

SHA512
9eb8d690854168dd3ee38882670369d5e27aab98b2ff5e0c3f9a069dfb14bb9be623ac5fa438996f7c8ac7cd54ff35a5a8d08536b92515521c804cce32971178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
315KB

MD5
7ab943652153db3f93e3071bae20e893

SHA1
c851e79560e2dc6f00c8b996fdfb3d90e49ffa6d

SHA256
964c25646a6b3011b5084ba093b80f7b969d760b9f04fb5d6987da8c76702adc

SHA512
d0af5f7533f7afd6e4014561ad69e0bcb6e0551a8e7cf97fc08bb0683aace8d08247e797fc9165f1320161de075039f5f371b68e48c29983d92cd7f85e55d002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074

Filesize
32KB

MD5
e7eb40a17f017e7b0651dec263c01ffc

SHA1
26fea5c5c688b2ecf33bb6892c9905159b6d48d9

SHA256
afb8e284cacb33c4d52af3a501a871cf560e4ec94358761743c02f3a21cb1810

SHA512
d7af8ff7adb71dd5ed1620efd913673e108846e02a7775d012825357fa81ab28dde7bce06592256e9f9c2e91ede6a249a7e6bce91a392f6f7ac0b53ac3ca0123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b13f46bbe0424a0a801ebcc0280405fa

SHA1
56d08e0c0839d82a7766fb35b087ec8fca396a3d

SHA256
cd214036fb0be95f955ffbc23273fdc1ba64f4becb5f402e9df33daa518a946a

SHA512
f5d4c5eb82224cd46cc7b53bcc8ede2c6b05207a67d9e420e64fff276fa15ba27c6af129863867b4dc9c98b018af773292e5109c840ddcd6e6b55ca8a31b91de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5291939da2946fe5ab110cc50007418a

SHA1
2599f63aa70b8fc0a9af370c16604447882ca80e

SHA256
532de756157c52a360cd7ff97ab91adca0b6420cf7e9c17d76997d45055833ed

SHA512
a0a8341bb097043159761232a0c7a3e1ed43e3323119af498fa5edea8fe3864757b54c58f09c37f6349a789b5130c97bd9ed038502a9068d8fe6c88676290117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9bd5c763e9b83a9cc924672f076090ea

SHA1
d361c73a368525799a225d03c6cca0036a328494

SHA256
a0739ffdad96209c108d6ef639f8b46e716987e7e68eb47b9cc3a46bb5ea5fd5

SHA512
31c84c6e6c9daff03227a47c4b5134ea654066d19d396e527e3f86f432af2f47b69257c375f925d24c8fb264a33a326838579fb727391b463c4ec6c44888ca28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
e64d352a7ee2b67d6df70eeb087ef0d5

SHA1
b868729075cd833fa12da28e36d25344433381c9

SHA256
015313e13754e42fad6493ecbdb987caade846cddb8ce5ac3f9b148b5c598ba1

SHA512
c3f6ceab860bc446dffa2efd2cda1dd48494964add6482b561d62635c59c28f4ab20daa5aeb8e58b29d4b615ff1d0a5d46c7ab9287a0baa1b29ab09d56eed65f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
2c4a1d43662878a051f92e330bc39336

SHA1
ab65b07bff121dd63d54642e55c3cd56d8d4cffc

SHA256
925d1a3deaf38c9c1e7be7afff4e6aa10c0d38a7613662ec535bba93c2f1a7a3

SHA512
a8af448722a7304f814d995b8eda1dcf3b5c8a2bb21efa51d4277e976f1bfe3f4c07f48ec72ed363f70f8f1bed2292f3823467a59ab76993f9f6e745c360f9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
7010e2dd307cb3373c1f89efe6ef836e

SHA1
fedf40e5ff9064f2c418d545fa864bb1d6f7e1be

SHA256
96b07b8ae27e0da7be16524568b6a5ba39deb546edd237ba2ee2fd08b85c6595

SHA512
197370b14ec3cbca52c6d79a6f838b155ea39c1e2578824e9c938a49fb842b812e4c3ef6d1da97b4c2fc655e40d4e2bc83b39621d6d54b5b6689c75333c34aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9acb6c75a71de2805779f3b97c699339

SHA1
bf1e52d2c2f30c14e9e6ed1a7af6772acb94e128

SHA256
d00fbb2d256d7d08bfa5db022eeedb0656ec92d3f9851ab2b466f5a78add8fbf

SHA512
1f98254f4913b1208195c75ef89e4c50df5577c81506e2721513d51aded56a37530436dd82269c3aecd6499810bb770708859d66c18581649edec0a518753feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58bc489b2a3e8b30f4fde2df7ec6d871

SHA1
5b6650fe4f9d4bfaab4bd612aa209d3c52e250a2

SHA256
f92493fd9199673c69f0af94831d42f31cf7a5ba8d12c2a0cedf8ac7405da84c

SHA512
c823b75e0378dcee8eab233224aca6927fae79bcf4e20ea2a2f39376ca08faecf370dc9aa1d291f6092d017e54fe437edbf1bfba13c8865719125a058d3e2fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
26eecf606ac11db3446df8a66972a764

SHA1
c5918afa3de8cf2651a439d13a4ce2ec989b56e7

SHA256
fa471fb63ad6723b69c9547e8854d0447443da2a99c7d7b463431631103adb85

SHA512
14aa0fa9e5530e17bce96f460fb44c759753f427ced84ab215ec99ef9d1b5252364215fab4b59bc4aa1cf2a3b3509685357c4bd7d5d03c9dd9726dae64be99ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da3b9f684329386e84583a313a29d611

SHA1
a7c6e5125c1be107a05ae09f016225c9d8454290

SHA256
681e7b60966fff64f8eea454a55c368ce4e49183f79fb4a5daf57e45d3fa29ed

SHA512
bd39f9cdd4c6970ecb7556c5b35819cc895225af43e7d765c2721c78828374a69cc5ec9a06c0711b82a36a7ad1b1726e846ec091765f80e29ef5f896a9686af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b313a71d0d015909590a70cd6e7b8c5

SHA1
a0d8668620ce6822c807dd1a570eccc317a9c16f

SHA256
726fbba0cac0dba095e2e1b5286f317829c881d0fdd2ba9c4826b3040be71008

SHA512
e616b857a41bd3c79211df14b5857770149172f724fba77b14c7627528568395af38ca995f75d9afddbcfbbf072c277b158e081ef7ed3ce14fa2f5fdbf3fb864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
bc25deedbcc7c60a04ab812c944dc86d

SHA1
aded18b769ffbe8e4efe6b0651b97142687d15cd

SHA256
2388e108093512321a5b90699a50cd8311bf0eb502193ec680eb3ae4b49d1151

SHA512
b8d6747195ac2023cc6a84d93614024ee7b04c5f9450461594ae0f33911b61c45438cf5dd0b0b80e4a06cf8943e842eb48cb4bd3b2d2b3df25af1527646dce5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d2a7daf1d2af91adbf7abc1e3e081cca

SHA1
a7edfe90c8fb10e5f3480d5cc3f4e866cbb116d5

SHA256
09c84a10e079700872abdc90e8196dcd8dc494a48f5cf2ead8d0218fe8725dfd

SHA512
078f7aec9c7b416be6f4cca28d5f265da9842233f89f7022f94b38c4c7ef770f37a566b1beda83dcc0ea4bd74e7f651748310288c1e613b00298b7d05582d1f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e693d4dfa585c4ebb0da9ddb8a463d59

SHA1
9925b8563c3e7c6b2c80d3343b3d5032ba4083f7

SHA256
ab26e99be55ba95d39bf66acbf4afc0747ba7ae91a627afad4c2907951faeba5

SHA512
88aa916b44d0f446932be657697955fa50824fdef17ff82683bae46e57976c076f447118210ae9f3f7c9302848439e4a8ffb864cf0ae4ffb6b3734718c507455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ff2ee08b13a53fc4435b0a3d3f965624

SHA1
fd1774674bf981dfc9f186a16fb3532b918299f9

SHA256
72ecf0e811cc00b82359188dc08d9cf1f3e713893f2b9c35115bd236a0d33358

SHA512
3cd1d12efd891f1859ab70c06c383f9995a5f37d708e30a1534ffc284d020646c2c2c2107c0ed6c0486cdfe39e1fa9ffd39041e76a69ec4273a950874841ce46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
70c6314b3043b0b3b38c537526d91131

SHA1
83afcf310fc84e361551073fb31997423353edbe

SHA256
6cbb5ce4c699b579af20f081d4d63053df374e69d8bc2481629bcd91ad8ac30a

SHA512
a696fa12cc77f48d77b77cb02ec86105d85ef38a38f06099b5f87fcb05f7867a41b51966616bf21e39161417248e2ba88c4475f825dc77b58b1c05dd8f3f79bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
53a69dd589c5f3064a636f2d1cf5cbf0

SHA1
516abff35e27ba69a82be81ec2744d87af8c1a25

SHA256
ced4a339c0cb4f0372d83809a4f69c9b670bad20284fd02c41bb50f3fd88e285

SHA512
a62b9c3c7da9d700496931f87c546cc27520c2c5ef99e5a230fa47df4c4485bd9e8361feddb967b557863569e3b883b4f425bc6b756f90e5002309c5287f77b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a7d35d67c74f884e9f54a007c309b91f

SHA1
4f4c3d6a735e72c8db5138af891ba4ee8825e22e

SHA256
d2cb537a049857d5a453b59db2ce5f839f81c58e8537450154eaf82322dcd310

SHA512
17300670b9ef04770dc9194a21c0acc69a4720a608c61891ca9665bdcc03fad99e42e42bef08322e9f5a9ca600b2c67d25c57a0baedb951f3fd678be2c3f066c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0af57fd91eb55bdd89b0af019b3acc24

SHA1
45291050dfc3dce3548862b7ba349838f75143ac

SHA256
9a19aa6f0b0ea3298df8d58370ae91a32c712f4dfbf387aaf29a350f7344a247

SHA512
d1545830791de80099c047ec0d5f4aa8e1db4527e029616c20e29173856002e8e9b7ba4c986a4ecbd3d40b89e9a2bfc3a9d9dcb83f8b951d3d8742a93534c2d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6c0522e2a3777bf46d32faf6348b00c6

SHA1
293ab763f9927b0c053cc8ee63e3931760496937

SHA256
2ddebe2624c21e4bf5d18221a7d20f08191d77b3e2880bb7e878b2300d6c853f

SHA512
cb1ba38493e80af984c15537b04b42f0024fb27343a63aa4fa795b8731c1d8c1ac1294b948519ae8f578adb51fe311c37d4a6304f4c68dc78e18935c417fd726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
46fdce1657331b745f0fff1d8e655fd7

SHA1
d689d7f3b5bef45ee26489ffec927e3fa9567d3b

SHA256
2fb766836a4b1f7b659675d51ae597c87cee85751f3fb266ac3d2b5d8fd8aa3e

SHA512
d1f23a04fad14133011ffaa4b7bd1517f5370215b76a2f1fefdbdf04f99034523d72c7e67a747e876f3083f853030e12a57f44af2c7dcd1270865a0bc73dfd31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
988e2cdc49ef7bf3ea234b1569eec84c

SHA1
a0796f4feb1f3469d8494632f38a2791c8ff86c5

SHA256
b7fa9fe85a7e1c7f3767d97291ca55cf936c4ccaadfe96b983fc39521618cad9

SHA512
cdb8b1bade424fdd67e5d10de377387860cf9eb0d25f5b4fd365f67bf19a0230290c5352e1d0864f4dad698e8b24b677f2a1f140a88055058e5842a077bb42ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
a83744cb6673a049e79acfcec0ab52ae

SHA1
5b9b9ad3a5153ab980f5923a61c8f64176d275cf

SHA256
291ae364ace93f2cf1964b74c0e59cc065aeed162bc61fcba2664fa8bb126281

SHA512
0ba9ebdae3f0b6de75360ae4a6f6118c73634a765a1247d5867f68a387144e085005267f6c00aabf725cad501f3c05ec285487afa087d065f08f17c4ba1f002e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
77b8aacadf9297bc33f75261fff3d335

SHA1
57af22ad0c00d8015a35a1c58a4caeaa1249e4da

SHA256
eba54015745af0635bb00e37761a1d48cdbbba0c6b0829e5acdf9df84d4f411d

SHA512
f003cee7f685c23c17ed97372825c7d413237fe60f369cc1b19d6430b9c7d0647ef715e95d1684a5fd2b8eff6bf2fa35f1bb85c4c349e63b4a1d23c3f79f54e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aad7ceab705aee95f4129e82fe1f2a9a

SHA1
c1c57daf18c0b39ae2bbf88fac6d3027b0978b7b

SHA256
e8420364d6c8c10d96844908ded1c3f09a81d498d57c52723e6473a5d5d661d5

SHA512
562a674e44bea687a8e47ea88bfe226a52382377a0afa2a4c83df767b0ac5fa77cee889b411b06881344d841a5eb7a1114ba75299e9f1dd639182f8fb5338fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585399.TMP

Filesize
1KB

MD5
6930bfbafec84cff2e3391c122e4b3c5

SHA1
7ff93a8b3d0f063fbfb9f1b9092db6a4f31dfdac

SHA256
343020e804cdfc295b1cd764acc6704a0c3413fabdb15fe5589d19a5c4dcee19

SHA512
e484dd24722d2fdf3713aa04fd0a02699ea817fd1cdea497c42a59343afcd4311ba02c77340a4b8a3eaaeeca9251405437d59a7470dca504349eb2579151125e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98c45dd91b5a8d5c9f2e155b034d323c

SHA1
426c297c835e950f6d4cfdbfabb720a7ad0816ef

SHA256
aa50d0a499d067cdc1c8fecc9b8b1846906acd1b0290389089bca10f928d43e5

SHA512
6992ffb1fd985fabbc07fc33bad0360ed9c64bc2d65f962c953f6c5a27faa9c53af4e58ceb37ba8e9c1f77d591669dd44acaa43a794eaf9cb952e7de457dc06f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2f4d1fc2b8f3c6c22811a64ab9536615

SHA1
52402566acda2f15405dbaf1b751499d0893862f

SHA256
cc37552b9c57adee933d933d5c904d723d63ec77bbcbc1a1d5f26eacc6c3dc54

SHA512
0206479cd9ec950bd994db488e895017edde9dbfbc8c4383a190cc3bedd5f6619c580efe1a899dc317dfaf799fdb532026fbfa00bad51c7ac76c9e7d205e83df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ac22832fea609488a84f698c2e0692bd

SHA1
aac9e60653ed241465e2accc117ee40b8b6e2c34

SHA256
8e4c0dac7a482c33fd8233ce13bf569f19e607eca5ff3bf8b4542fb37a0795db

SHA512
e97ed4a9bb0b63556bca58862eb1c35e7538b30b66dfa38a1e7d4f4fcfab3f219c7b480242f25d60984e9383e63ead6067237535d807a91d88c4f1215f570888

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
1301a13a0b62ba61652cdbf2d61f80fa

SHA1
1911d1f0d097e8f5275a29e17b0bcef305df1d9e

SHA256
7e75ad955706d05f5934810aebbd3b5a7742d5e5766efd9c4fc17ee492b2f716

SHA512
66aa4261628bb31ee416af70f4159c02e5bbfbe2f7645e87d70bb35b1f20fa915d62b25d99cd72c59580d1f64e6c6b5ad36ace6600d3bcdb67f45036d768ed8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit