Analysis

  • max time kernel
    153s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 15:04

General

  • Target

    6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe

  • Size

    1MB

  • MD5

    448167188d4f47b825a5aa8c0ac12f3e

  • SHA1

    52706abe223080b9f905174ff3d1a1a35e3db081

  • SHA256

    6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6

  • SHA512

    97b970972b29d62c40a06b0d2cf06424c20cb7eb1b2fa199c39ed6f3c9b582e84f89ba3083d49d278a4342611a373e129842b385ed3f9c9d91860bf97e0eeafc

  • SSDEEP

    24576:QmO82iSkvu+T2tlgdW2fsJVlRnTR8GPPd6ZOJ6mYuCCN+R5KU:5O8bSkm+TgsW285n9bP+LZH5KU

Malware Config

Signatures

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Detected potential entity reuse from brand microsoft.
  • Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 2 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry ⋅ 2 TTPs 3 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary ⋅ 7 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe
    "C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe"
    Suspicious use of NtSetInformationThreadHideFromDebugger
    Suspicious use of SetThreadContext
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe
      "C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe"
      Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab74a46f8,0x7ffab74a4708,0x7ffab74a4718
          PID:3696
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13190979247136306019,18201311321367652484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
          PID:4632
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13190979247136306019,18201311321367652484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:3
          Suspicious behavior: EnumeratesProcesses
          PID:1740
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        Adds Run key to start application
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab74a46f8,0x7ffab74a4708,0x7ffab74a4718
          PID:4580
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
          PID:980
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
          Suspicious behavior: EnumeratesProcesses
          PID:640
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3092 /prefetch:8
          PID:3576
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
          PID:2384
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
          PID:4712
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
          PID:1300
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5544 /prefetch:8
          PID:3428
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
          PID:4072
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
          PID:3248
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5868 /prefetch:8
          PID:4616
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
          PID:1272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
          PID:1880
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
          PID:4872
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
          Drops file in Program Files directory
          PID:1296
          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff709955460,0x7ff709955470,0x7ff709955480
            PID:1132
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
          Suspicious behavior: EnumeratesProcesses
          PID:2340
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
          PID:4684
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1872 /prefetch:8
          PID:2264
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6768 /prefetch:8
          PID:748
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12307406717222213510,5461115381184190273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1860 /prefetch:8
          PID:4288
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    PID:1592
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    PID:2840

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      fc4451743ae6d96d07076f3062309c18

                      SHA1

                      ffe7b073fc93cc73b1779d73528763a15c701ec6

                      SHA256

                      1e1ab179c71a268faa3558cb48f11d2c9ea8d30f6cd6b90d8f5a68c03769f6be

                      SHA512

                      c2d22f63a041d8bcd2440b89aa12f6e08b6e483a637e6bbee20e83803dc0d9ea3fb826e8a33612e5d38f55bd34e5a80961ec35ebade192fc72f7a281d2fa7ac5

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      a5373eb6bbc76d238ded0f113451d354

                      SHA1

                      adef981a5146c2cdd07b41288d04aedef806081e

                      SHA256

                      6c0c9949b02b5614cf9afadae3d4a6800856da973e3fb068ba4bd5768dc67db5

                      SHA512

                      983c2781fcc8c06e634659fa98b53ed845627dc436fe9d141e10335d4f138cb95f2fde380f664db466bbc7a87a2491e0f271fb26891535745de1b5ab069e6653

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      a5373eb6bbc76d238ded0f113451d354

                      SHA1

                      adef981a5146c2cdd07b41288d04aedef806081e

                      SHA256

                      6c0c9949b02b5614cf9afadae3d4a6800856da973e3fb068ba4bd5768dc67db5

                      SHA512

                      983c2781fcc8c06e634659fa98b53ed845627dc436fe9d141e10335d4f138cb95f2fde380f664db466bbc7a87a2491e0f271fb26891535745de1b5ab069e6653

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      a5373eb6bbc76d238ded0f113451d354

                      SHA1

                      adef981a5146c2cdd07b41288d04aedef806081e

                      SHA256

                      6c0c9949b02b5614cf9afadae3d4a6800856da973e3fb068ba4bd5768dc67db5

                      SHA512

                      983c2781fcc8c06e634659fa98b53ed845627dc436fe9d141e10335d4f138cb95f2fde380f664db466bbc7a87a2491e0f271fb26891535745de1b5ab069e6653

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      e1661723f09a6aed8290c3f836ef2c2b

                      SHA1

                      55e08c810da94c08c5ee54ace181d4347f4e2ae5

                      SHA256

                      a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

                      SHA512

                      dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      e1661723f09a6aed8290c3f836ef2c2b

                      SHA1

                      55e08c810da94c08c5ee54ace181d4347f4e2ae5

                      SHA256

                      a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

                      SHA512

                      dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                      MD5

                      5a61ade36d5d6e49dae2e2061717bc51

                      SHA1

                      b630ca8867aca2172ebc266b7594a2bd1a82e9c2

                      SHA256

                      fa0541c59ea3ac545f9d5c6256802c24a20080d0ebc0c0b3a18cd56af0ad92a9

                      SHA512

                      762c498463c101bd5cab419662edf6ce1f6d23d434147e73ac929131cf387d687afdc4750dd940c418258ea15edb686771806396c19aa5db9cfa2e033bcaa5b2

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
                      MD5

                      f222079e71469c4d129b335b7c91355e

                      SHA1

                      0056c3003874efef229a5875742559c8c59887dc

                      SHA256

                      e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

                      SHA512

                      e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
                      MD5

                      6698422bea0359f6d385a4d059c47301

                      SHA1

                      b1107d1f8cc1ef600531ed87cea1c41b7be474f6

                      SHA256

                      2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

                      SHA512

                      d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
                      MD5

                      55ded4b8505874c94663203ce0e8b345

                      SHA1

                      aa4957de51da83a05fba180140e2d31d4b89f101

                      SHA256

                      6173a5c2e96bcef843c359f0aecdff1cc6da6f46a879644783e0c3849d77c9bf

                      SHA512

                      eda923cb3e24907aff08fed19944933d919dd995b73394104b8a3c3562072aac6ad94881d962ddf4cef39024964999d93d5a6ebf1e1a319cd74567524defb20b

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638003346899613659
                      MD5

                      627eb0b592e61ca37b19107b83098924

                      SHA1

                      4de1e8b7ed207a09cc48f67d2dc8a4600109da01

                      SHA256

                      16d64d736d8f5836e9b8944539568c18fe58c8b920924ea51688aa92b1dbead3

                      SHA512

                      42448a08c3dcd9fc22edc86a76745732fe79ca9d832f9885db9d7a6539001ba8282d8923acbca05fbcd866c8792a41e7a7a4f79306e65ee34c1268ff99c3bfdf

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
                      MD5

                      d4dba390ab9454a5408405d55f013558

                      SHA1

                      f3ce9d1b11ba8cb019cac4178a37b4a7d9b72891

                      SHA256

                      fa728d3a97a5694c54522b3bbe9ae4fef0970ef62b1bab8ba316a56f8e429caf

                      SHA512

                      ef0b93e93758b60816ebc23a44fdde3cf3dc5ead7f9db4fe0caa10159c9a171541149d17366b1f64c62d3933f792d757e8dc96b15db31920a7f49ccef506666d

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638001453611427348
                      MD5

                      e9c502db957cdb977e7f5745b34c32e6

                      SHA1

                      dbd72b0d3f46fa35a9fe2527c25271aec08e3933

                      SHA256

                      5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

                      SHA512

                      b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

                    • \??\pipe\LOCAL\crashpad_1512_GNDGMWVXOANUMGOD
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\pipe\LOCAL\crashpad_4556_XQMSRDALUYQIAEGE
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • memory/640-153-0x0000000000000000-mapping.dmp
                    • memory/748-196-0x0000000000000000-mapping.dmp
                    • memory/980-150-0x0000000000000000-mapping.dmp
                    • memory/1132-189-0x0000000000000000-mapping.dmp
                    • memory/1272-185-0x0000000000000000-mapping.dmp
                    • memory/1296-188-0x0000000000000000-mapping.dmp
                    • memory/1300-174-0x0000000000000000-mapping.dmp
                    • memory/1512-138-0x0000000000000000-mapping.dmp
                    • memory/1740-152-0x0000000000000000-mapping.dmp
                    • memory/1880-187-0x0000000000000000-mapping.dmp
                    • memory/2264-194-0x0000000000000000-mapping.dmp
                    • memory/2340-190-0x0000000000000000-mapping.dmp
                    • memory/2384-170-0x0000000000000000-mapping.dmp
                    • memory/3248-180-0x0000000000000000-mapping.dmp
                    • memory/3428-176-0x0000000000000000-mapping.dmp
                    • memory/3576-167-0x0000000000000000-mapping.dmp
                    • memory/3696-139-0x0000000000000000-mapping.dmp
                    • memory/4072-178-0x0000000000000000-mapping.dmp
                    • memory/4288-198-0x0000000000000000-mapping.dmp
                    • memory/4556-140-0x0000000000000000-mapping.dmp
                    • memory/4580-141-0x0000000000000000-mapping.dmp
                    • memory/4616-183-0x0000000000000000-mapping.dmp
                    • memory/4632-151-0x0000000000000000-mapping.dmp
                    • memory/4648-137-0x0000000000400000-0x0000000000729000-memory.dmp
                    • memory/4648-132-0x0000000000400000-0x0000000000729000-memory.dmp
                    • memory/4684-192-0x0000000000000000-mapping.dmp
                    • memory/4712-172-0x0000000000000000-mapping.dmp
                    • memory/4884-135-0x0000000000000000-mapping.dmp
                    • memory/4884-136-0x0000000000400000-0x0000000000454000-memory.dmp