Analysis

  • max time kernel
    157s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 15:42

General

  • Target

    58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da.exe

  • Size

    86KB

  • MD5

    027d8cca3d1d316e7196071497500ec0

  • SHA1

    34951925b9ee92fa180e02bd2d5881c3c8e100d6

  • SHA256

    58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da

  • SHA512

    5b54d3a0cbb479ee59e8c2962db051c518fae9740e07162559174efaed2c6cc129e5c00c50591abf242f8500f9e1c241abed40563283df02715ff31d26e7882e

  • SSDEEP

    1536:hrUlDSCPWWum6e6mm/ASwwb5RUUgN6FEseVqmyNgNlq3J65SGIGSV:N8DTOWuhe69/Xwwb5RUUgNKYklgNlqVp

Malware Config

Signatures

  • Adds Run key to start application ⋅ 2 TTPs 5 IoCs
  • Detected potential entity reuse from brand microsoft.
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry ⋅ 2 TTPs 3 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Modifies registry key ⋅ 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary ⋅ 7 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da.exe
    "C:\Users\Admin\AppData\Local\Temp\58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:3504
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
      Suspicious use of WriteProcessMemory
      PID:964
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
        Adds Run key to start application
        Modifies registry key
        PID:2280
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
      Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
        Adds Run key to start application
        Modifies registry key
        PID:3044
    • C:\Users\Admin\AppData\Local\Temp\58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da.exe
      C:\Users\Admin\AppData\Local\Temp\58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da.exe
      Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        Adds Run key to start application
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        PID:4492
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde5dd46f8,0x7ffde5dd4708,0x7ffde5dd4718
          PID:3012
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2376 /prefetch:2
          PID:2256
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
          Suspicious behavior: EnumeratesProcesses
          PID:1844
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:8
          PID:3140
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
          PID:2220
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
          PID:4500
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
          PID:4200
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4392 /prefetch:8
          PID:1124
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
          PID:3536
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
          PID:3704
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5504 /prefetch:8
          PID:4932
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
          PID:4272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
          PID:4076
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6664 /prefetch:8
          PID:2292
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
          Drops file in Program Files directory
          PID:4484
          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x200,0x22c,0x7ff7fa175460,0x7ff7fa175470,0x7ff7fa175480
            PID:852
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6664 /prefetch:8
          Suspicious behavior: EnumeratesProcesses
          PID:3572
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8
          PID:1316
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2340 /prefetch:8
          PID:4452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,3895928483989546676,8458501788430431058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2332 /prefetch:8
          PID:3320
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=58ce17682e4d7dd7e3e3937f796543b1504aa58301561ce45962793ded2fb0da.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffde5dd46f8,0x7ffde5dd4708,0x7ffde5dd4718
          PID:1472
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,362955672618875905,16582614612455052893,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2392 /prefetch:2
          PID:1096
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,362955672618875905,16582614612455052893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:3
          Suspicious behavior: EnumeratesProcesses
          PID:1732
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    PID:3156

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      fc4451743ae6d96d07076f3062309c18

                      SHA1

                      ffe7b073fc93cc73b1779d73528763a15c701ec6

                      SHA256

                      1e1ab179c71a268faa3558cb48f11d2c9ea8d30f6cd6b90d8f5a68c03769f6be

                      SHA512

                      c2d22f63a041d8bcd2440b89aa12f6e08b6e483a637e6bbee20e83803dc0d9ea3fb826e8a33612e5d38f55bd34e5a80961ec35ebade192fc72f7a281d2fa7ac5

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
                      MD5

                      18c5ce66b5fb6e5f744da99e7bf49c2d

                      SHA1

                      ebc776924a1095dfd21379a8df954995ff5c54bf

                      SHA256

                      e3f8d374fb04424f91bc57bccbd493cac0fc6e66506b1fed05a4d5aeb5ecd9e9

                      SHA512

                      63f9420456899909c25f81e89bd99d8c4f1c66488c03d7de814d81844be27a28854dadbb3e54f307ceef48b4afe577c4a2c0c9dff4f42e3fe38246f8c0f4c8b9

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      7f9a0bb2230a2daf0ead4fc822810143

                      SHA1

                      a3a653d7c37a11e395bf2036440050c4bfd9813b

                      SHA256

                      a7479183e84571885069d9b910833405f0bd27ae44bc0ea6144d3525e93cdeee

                      SHA512

                      8b47d04b9a22f445f297ab2221973574fa41b2f8417a8898746a948c2a17c11177291eddeab2a93ebaeeaa2347882d2284f53d2f17e25e67cabdf7b6884bfbc6

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
                      MD5

                      7539febe1f8d37cefd33f3dde8ddb47c

                      SHA1

                      90214c05b68f9eb0923f8472977233fdcc3a344a

                      SHA256

                      c9b2594480cb5ec4a4f0d9c4f189995f14e171ffaf76ff9612db81dab9da3858

                      SHA512

                      6fd3b8408258409b44fe01414e6d5278b7e6d157738a74e56a61b076aa31cd3b422c243e112b4f1a349620d78125f0557301907ac0fc196017a59715c3960f94

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      e1661723f09a6aed8290c3f836ef2c2b

                      SHA1

                      55e08c810da94c08c5ee54ace181d4347f4e2ae5

                      SHA256

                      a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

                      SHA512

                      dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                      MD5

                      82e000d642a4432b0f5927ea37c385ed

                      SHA1

                      07e27c39bef58eac637833b63c6d3c248d2fdda0

                      SHA256

                      07c50696e698d56e4d345ff1af1e546bc07f32fa922b5f6a40bdba92b0e29d62

                      SHA512

                      05cf7918fa152ee953b1d4c354836ad57e270834558c1b1ce7ce34d561db447c54b285fad8faed49cfa230e12b3031c8fddf61f618004763ded0c01138c62ad3

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
                      MD5

                      f222079e71469c4d129b335b7c91355e

                      SHA1

                      0056c3003874efef229a5875742559c8c59887dc

                      SHA256

                      e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

                      SHA512

                      e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
                      MD5

                      6698422bea0359f6d385a4d059c47301

                      SHA1

                      b1107d1f8cc1ef600531ed87cea1c41b7be474f6

                      SHA256

                      2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

                      SHA512

                      d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
                      MD5

                      48cbfb314feebe9623114678be1d29ba

                      SHA1

                      7f30c391acb5d64b4765883343d66aed495fca84

                      SHA256

                      c257ca6ab7eae289aa12287a1dd478f688a341658c54ab5965dd42c7124e84a3

                      SHA512

                      2a2c7638318bf69640ad524a4e9b798f1cfd9ced30a1f2c941657f8ba1ad69c4d7c95780a80cf14fbe1e9c4e9b3a2dcbc5bbeb30a0904b8510bfa6e53396255a

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638003381757122317
                      MD5

                      627eb0b592e61ca37b19107b83098924

                      SHA1

                      4de1e8b7ed207a09cc48f67d2dc8a4600109da01

                      SHA256

                      16d64d736d8f5836e9b8944539568c18fe58c8b920924ea51688aa92b1dbead3

                      SHA512

                      42448a08c3dcd9fc22edc86a76745732fe79ca9d832f9885db9d7a6539001ba8282d8923acbca05fbcd866c8792a41e7a7a4f79306e65ee34c1268ff99c3bfdf

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
                      MD5

                      d4dba390ab9454a5408405d55f013558

                      SHA1

                      f3ce9d1b11ba8cb019cac4178a37b4a7d9b72891

                      SHA256

                      fa728d3a97a5694c54522b3bbe9ae4fef0970ef62b1bab8ba316a56f8e429caf

                      SHA512

                      ef0b93e93758b60816ebc23a44fdde3cf3dc5ead7f9db4fe0caa10159c9a171541149d17366b1f64c62d3933f792d757e8dc96b15db31920a7f49ccef506666d

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638001453611427348
                      MD5

                      e9c502db957cdb977e7f5745b34c32e6

                      SHA1

                      dbd72b0d3f46fa35a9fe2527c25271aec08e3933

                      SHA256

                      5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

                      SHA512

                      b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

                    • \??\pipe\LOCAL\crashpad_2620_QNHEQONWUVTQTTIF
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\pipe\LOCAL\crashpad_4492_GORKBCHSXAUXUAUP
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • memory/852-187-0x0000000000000000-mapping.dmp
                    • memory/964-132-0x0000000000000000-mapping.dmp
                    • memory/1096-148-0x0000000000000000-mapping.dmp
                    • memory/1124-175-0x0000000000000000-mapping.dmp
                    • memory/1152-134-0x0000000000000000-mapping.dmp
                    • memory/1152-135-0x0000000000400000-0x0000000000412000-memory.dmp
                    • memory/1216-133-0x0000000000000000-mapping.dmp
                    • memory/1316-190-0x0000000000000000-mapping.dmp
                    • memory/1472-141-0x0000000000000000-mapping.dmp
                    • memory/1732-160-0x0000000000000000-mapping.dmp
                    • memory/1844-162-0x0000000000000000-mapping.dmp
                    • memory/2220-168-0x0000000000000000-mapping.dmp
                    • memory/2256-147-0x0000000000000000-mapping.dmp
                    • memory/2280-136-0x0000000000000000-mapping.dmp
                    • memory/2620-140-0x0000000000000000-mapping.dmp
                    • memory/3012-139-0x0000000000000000-mapping.dmp
                    • memory/3044-137-0x0000000000000000-mapping.dmp
                    • memory/3140-165-0x0000000000000000-mapping.dmp
                    • memory/3320-194-0x0000000000000000-mapping.dmp
                    • memory/3536-177-0x0000000000000000-mapping.dmp
                    • memory/3572-188-0x0000000000000000-mapping.dmp
                    • memory/3704-179-0x0000000000000000-mapping.dmp
                    • memory/4076-185-0x0000000000000000-mapping.dmp
                    • memory/4200-172-0x0000000000000000-mapping.dmp
                    • memory/4272-183-0x0000000000000000-mapping.dmp
                    • memory/4452-192-0x0000000000000000-mapping.dmp
                    • memory/4484-186-0x0000000000000000-mapping.dmp
                    • memory/4492-138-0x0000000000000000-mapping.dmp
                    • memory/4500-170-0x0000000000000000-mapping.dmp
                    • memory/4932-181-0x0000000000000000-mapping.dmp