hxxps://shrt[.]asia/xelQx-zZ

Analysis

max time kernel
418s
max time network
419s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2025, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://shrt.asia/xelQx-zZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1170604239-850860757-3112005715-1000\{8D35B33A-590F-4E36-8006-8A21423CCECF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
3352	msedge.exe
3352	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
5208	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3608	3352	msedge.exe	86
PID 3352 wrote to memory of 3608	3352	msedge.exe	86
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 516	3352	msedge.exe	87
PID 3352 wrote to memory of 2964	3352	msedge.exe	88
PID 3352 wrote to memory of 2964	3352	msedge.exe	88
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89
PID 3352 wrote to memory of 1932	3352	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://shrt.asia/xelQx-zZ
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc561c46f8,0x7ffc561c4708,0x7ffc561c4718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=1420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1184 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12929746405204664661,17473287582097343809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e77abac3d03f5b27ca6d587bff7cfce4

SHA1
2398274b1f425b428b6860d225d691ccd6cac355

SHA256
eb56f6b62d68039ebff870d1968be6d2499c3ef9046555c20b1623eaeadf5c03

SHA512
bfb7aa7973e3ef57df95a42c7ce0e7ec1fa4afe0276802f38f3791e4a4d2aa9af300887fbca7297b75276415ecae7cc7ac0c413a3c95345e7b3354407c770a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71678a9de9a3336190ff95537cd87a7b

SHA1
9e213afb4f6397c8e64c2bcb8cd36931845a0474

SHA256
ac58d2d4beb00dc62fb0a5b50cac02d2529cb51733065ca5f1763bd810371c3c

SHA512
5f402598e4533d1a25e802353387725753ce54c7638515f91d80db2eed13ee9a676ae401e47ab424f57bdd5f3d6b75e577027fee10ded7cea0d99cbbd3c0c937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
bac2bbd313541a747beae592d0a28542

SHA1
4ebc4ec33f89c9baa6b49a62cfbcf5daed887ebc

SHA256
330b62b3ce76531276c9080f4e48febcf7fb6bede96e6cf7408bbff6308c0132

SHA512
5f0cbc1dface7898b17114342f59f5fb04492d4d74112d73ff97274bdde2d591a49bf9a35e319401ffc38c9063ef0f1c29f154f92ecc6851554f0f2961d91740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
38f8d9173bbbc76420ef403be2381244

SHA1
44697b7356573325c3c59bddd533df89e061752c

SHA256
d6110a18de1f429521ee62b951cd1b12a275b4547d22dcaf2a126b49c2ae9652

SHA512
fe7d3be7d300138f179c1174e7486cdb68d0eeef343262f7388b185a14cedb29ffc0b40680a79cc3e4bf398c96876d95332a348d2e0191026ad0c20ed85cc279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
55eb7d957ef67463195824c0b9efe158

SHA1
5ecbd032434bfa00cadeea856bb7e35a9fd0eb76

SHA256
61d3e362a66b6073fd86fc8a9bfbbfec7ebd645fec9641a30d50a2ed1af39765

SHA512
953990031dfed6081a20465013b064f8940a3242c8ad8174b3b19141ff3c23647762b3ed07eb3efc8a25735e71822121f175275c6f9ed1ca0f8cde944329ec61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
36c82c809676ab118d9bd1caa129d604

SHA1
572af311de8227e4957966393bf467a88b6432f4

SHA256
08cd061e2b4ecd7440f77d5baaa7e24429f074d79e0ae26a09cb7c4a1a68ebfa

SHA512
aa4049ffdca5cc0b658947b67c4cf0eeac986f07e49836f5fc002967ab9031a952294c317d96189d62555776d98b888a80e28e9c8cb7f3c4571a30828cb18a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
342a0b5dfd8c46d8dfe4ff5b5fb1cf34

SHA1
b35371a93fa8fd4e0e3860759ff62438609e5afe

SHA256
a1e001606f854a106225988cd5e6a75a34c8d821ab83de70167d039a4d8ec7cb

SHA512
174dab31bdab3589ab97caaf5c0d6fa236349bd8fe887f0df7850437081e55de5f60ce60a4fbd2964e02a2f91a3457ece1d8cd2ebc2fd77f34a5434000807bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d6197f682dda9c9f86bef50dc9f5963

SHA1
66fc89492fb06774f6d3b27eef97fc573db86ae1

SHA256
76780502d52283b729b2d49b797cbb5c275ce573d7cbf332a60c025279c6a064

SHA512
c9ce8b77ed4b96ad259bed565e328313af0adf66e21f654d71967c0fe3f1141cee796c3174556fc2d9ca2ee72731187754d84cad9c22213f580f981313c31bc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4d362f6be47dd79d1dd2b789904db638

SHA1
894577800812465c608103a203dcce295f2e314d

SHA256
a6d911d70e2e931dab6fa81b4a7a0e37d34e596c52821f5959a00779fd9c7dec

SHA512
3b1aeb533664768261f1c910078094dbf7b0867edafa14d4b8230b19a7fad1a213cefc2adadb3604d544d9a0c71858cdb70717ac9ddf803c6cb02c0be0850dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8b55b238d1ccc0cd3ef0ee4811e5090f

SHA1
b4d2dc2581f885cfa74b6c203f68d7276290c2f9

SHA256
e04e0c9acaa47d33971b536e54bc594fccaa123e43436708a1e336c2e2fb1c0a

SHA512
57b0eabff545604cb17e3ee96d52ed7a23e4a14e54227935384e771f77dbdd2bd5a9b7e707f98e621532e78260033ce786dbfc1ae8ea175950c543a562935060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d3335d2aa6787db3882de4466a641de6

SHA1
d8c752978e982f2c671c0be3325c92766bf3eb1e

SHA256
26008648b48d3bcde902f49f3d63ee9787e58167e5dcfd4e9743d57f5f88f1b7

SHA512
c2cbdb8b35e4a9ff9ec9da645880a5420f910d31014532e7862a2e7ee41b4c46432465f861f476c3e4c0676abe06f95fedf362e0d4e9ea008dac166fb0826d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd87ab3243f6f32d7716574eb8461423

SHA1
be3ed4475282fc868ccc51234ac9d3c70ec63ca4

SHA256
db7d7e591a4e0bbf935dbbd04c097dcc7d350fdb499e141757c490447ee1c151

SHA512
fa5e18b60cdd118734a5f2eeac32329f92569c5f2977fb927727d503ebdeef027a4097d3edf76fc3b1c88bdc7bb6f06afe04fb52397063aa22a0120a3c441dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
60b0c387eae95517ab0251fd74dee319

SHA1
e5440421bbbd7e6d8b26cbff413ec04b3f1542aa

SHA256
37b5f431e4b7034628f87c14d2618216e6471f138e181bbad2e745d40cc2ae40

SHA512
ae7af8857efba22ccaf36a270a98885797b9a2455d96713fe9aad3af8d5251f5f6ce80a441c4685ac37f7bd94b4049fd350d453c0892d76591bf312bde449dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ce687527b71afa8f4c725b775cbec85a

SHA1
b58834bb8c12ba96fff6c1580069ad05b6f062b1

SHA256
ed6a1eb144a62180d55f7bd7c722eb15e41ce22471794ba8375acf5520fa6f8d

SHA512
22bc848b64d2950b3fc46f428acbea26b22d7f5bb40d782d9d450b22179a4aa29a13d560a48f6f7cab6558c150d591710a6a17fe4200e8c31ac38c62285f9dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
329664d8f7b3d9905a5f5ea3b1774760

SHA1
2b5aa9056fbe1f0b5587c54d9b17b552a351926e

SHA256
89b8ee24652ffac5c93e9b0392670827a5f252f03e73cf82a37afe7cb4fe00eb

SHA512
5682c54198d23266f9696a8f7f6703d9c58c3bac47dd7abee8d4a58d6a0e97516ec299c09f6205a21318a0a51395fdb20d7dd5f8d20fb6ec50ac46c7aea7de5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
962fa46af17d891baac560226882a673

SHA1
9bb82465a5c836de47e66b06e69b53d69720eb4c

SHA256
7fc802d14e5974b7ab907940a48b5e5e5c3ed77a362eda93d02f63fbcdb3300c

SHA512
fd619b24eb60c6c09abe7f5d2a3a1540680614cf6f2ef472128494db663ec74ebe5f3426b8ccd5220ff7bea41ca89ed77336eca6bdd66e16389ad4a1a94703c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4b1e7acd32825c7f744f494e7081e758

SHA1
eed26dc816512e0fa20db9c7d3fe946a2d7fe516

SHA256
253253417e3ebff861efe55924d12a6508f7a322b2c0cfa79fb8ec635cef9ffb

SHA512
d8c055b43d75b029908d10cb2d5310f99fdfaa741a406bd9cb2c6a7d606eaa1373dc8ae256403572ef9dbf60315505134fc668c9525cf76638c895a5d2f083c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c4c9e0d50a4490f998b4fdbbd211408f

SHA1
1da00cdfd06c96acdd250ccc6c4012fbae93a30d

SHA256
6bd92a5601dea8e5290cd2eefc218f76fbcc6bd380392ff98a6e135a9d20f33c

SHA512
6c56fa90ac8c90b8bfdceaa45f0b38e7c09f34da197f232fd980240cd6993cbb905ebc213911447b577326459690b55608ff0576440b286114c2f3ff28954ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582ce7.TMP

Filesize
48B

MD5
c81337e3a4cd75ec79dcde153d045ac8

SHA1
b98666f65090f653aa8fa2a264017c914326d70f

SHA256
b0f393e17f4394a0a7f26cb660bb844ca63d00a1449ca62222c6bbf23fb2c58c

SHA512
67cc40819d89254a862d5f15fd2d968ddbf11ef9b290b90aa8a7119716ad4c3df7e76f887e785ec61116dec6937b4d45679d11c97ac0967eb6556d625f0f9a45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d560c1a19e8a7e03866a46d0800c437f

SHA1
de8e0ccfecbcf1b7a022d978235e2629a17690b2

SHA256
c0b55a0246e04471d5e153843b07fcf24d272c33901f1018c2d5ede6973f85f3

SHA512
dc56ca0325d5d986cddfe8ebf0fa3c18ab47f9f0e9071c0a41fe7dcd804fb12e38bb9f146aa5483aa597b240c1479a7be75fa10a3f3e5e12be4ed4511e9c04b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2be90c86c14188b87be1beedda8bc765

SHA1
408f347f2cc7b6c00d915cc2a9fc9732aff1e465

SHA256
891ef85015c73a02b4fd9087c03d070d657136fb54eb94a8cdc8669ee76431bf

SHA512
4fd45bfd10afa3d5bb0733b2a92aaeebf0591f8c928ba0ae4ba28db2c8a76020422ff39c456c6e9ab88f14c9f374868484cdd20a725b8fab0da3c82a61f2ff6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ff5c49200d8dc15213603f256cd923f2

SHA1
f27ef3f3532a082c4077f924985b74ec3a717df6

SHA256
ce12533f79808df1cf22be4ae6454dcfd75e44721df656480699f321aca08049

SHA512
8623417d1d8ab52d10cf48329e5ad69e9b167c6642cd47a7e5c85c5be39086ab606fa04e6aab03f1194d201e2b9427758881aefd2a3843d3e01e23351bc86072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
311a7a2240777b949d87c7fa1eafc7a2

SHA1
b4397b5e70bbab9ad814f04613698272fdce92c9

SHA256
be949bbb36224dde0cacae5915a7cd31ae9be4778a1aba3461d26c68f7b24f0d

SHA512
3146e0dd74b62fe655d29790e811e17796f89f02298d95f8c9adcc2550633c062bc77997973c1395c2aa1b483fc7196ec82f759b9cb66c9845edc0602c7558e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
27c4bcde87a130f71350cbd74d3fa211

SHA1
c13e551dea3986e34d0d9afacfe68e5400a35401

SHA256
b7597cc232cf6b70a7fafb68400d58a38e66fa77b97f07d20498a76a45625d81

SHA512
2fd2c0c0b2337bcd262d17ded1b37280bfd8225d501baf17f912553d187abfe0f5517969379db2d7c28ccbc189c72025b344e28480fffb6a4dceb5b82a55934c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4eb3933012f5a4416b4aed972611426f

SHA1
b4c5fcbb4ff0cf526e89dd184229a6c7efb1a85d

SHA256
e6d4b7b3f4a17c32be038ddc3acbf0e31a8bbd707d8a2eb19144ccd9a0f41e40

SHA512
77af135bfebe8fca239691a1f2e9fe8a0d1b3399ae9f984b677a4996f1259a174dbcdd1e8b97a2015315f64a10b49189d8b073a9a00e7af35b1fa71f9d5d2c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
26b81208371e5da811bceeb2276bb5d7

SHA1
b786b23643880e244fafd6a2add16e3d614ade01

SHA256
4928f4f7e7893bcbfbd978780317510efe221665d65b3b10a48284d1edb95f00

SHA512
10c2d20f0a8a6cc1db798a8929317039efcfa049807d1532dbbaad942e1d6d684efeb4a904e3a4e9214e5a5769264251e155c9b71a543fedbbcbc87fb36d53db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5825f2.TMP

Filesize
1KB

MD5
162904ccd46ec2ed06ff4a9db3f82186

SHA1
b23bd173a01ab0ccf47c0726f871f5d7aa64ba7d

SHA256
c1254ae30fba8aeaa83d19db4127b188e8e34cb87bec2d5728ca30b1a050e22a

SHA512
cfbbf7a17197110da69bdb739fb4f2ab517f4339ff4aa45c0001e0c172a071ee9fb1d53b54d52d5a07d162a8e68dba7b7962925c5221e49d2e51d85a45f3b392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9aa54687e25bb2919d28a34014241cd8

SHA1
e65037adfb7d67ce41e5ecd64f9296e258d1a085

SHA256
2bcdd2efb22e4f073a1a4d4e428254c87ece2a325db2c33351947a45230f5f76

SHA512
63074ec2c40940191e649c931bf7d847ee44305961afcbdfcb579310d8b1f38f1f4fafc3e7e055c92bdc39ebd0802bb30eedbee06179e3ac17efbcc7de1b2983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b4ce01672825cda2c71f3544582236c

SHA1
2bd781617fd0eab59a6fa53b3669b26092f460ba

SHA256
2889f4f3721b6b0b3a7beec43f35454991de282d080b12edcac1222641cfdd0b

SHA512
66701ca5018d5a6c10569c04176f5ba7f86fc26cd50043f2e1420c13d849da49f3dfb7ace54d043b2b8d5690a66c13bd7028525127becf1710ccdd13436bbca7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit