Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 16:25

General

  • Target

    4c61050d63d3e92add0ccc4274dc05c340a6ed5c72d3fab1ce88b06e74611924.exe

  • Size

    340KB

  • MD5

    67c87bd1151b4f50627637f9828c77a0

  • SHA1

    b1824f98cff69668f927a9da8428659976a2056c

  • SHA256

    4c61050d63d3e92add0ccc4274dc05c340a6ed5c72d3fab1ce88b06e74611924

  • SHA512

    7f84e1e4ce31836896fb87cd5d06bc5ac5a272d4c40d2a663216363947991231d552bf1c2731b4abe76bf50885b7178c536471574cbd51a17eb2b90cb8e287a4

  • SSDEEP

    3072:sNQx6QrIKHgh5kaeQh4e4ee4vg0+/gO2GYbFH:skxgMalb+/geYh

Malware Config

Signatures

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Detected potential entity reuse from brand microsoft.
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry ⋅ 2 TTPs 3 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary ⋅ 7 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c61050d63d3e92add0ccc4274dc05c340a6ed5c72d3fab1ce88b06e74611924.exe
    "C:\Users\Admin\AppData\Local\Temp\4c61050d63d3e92add0ccc4274dc05c340a6ed5c72d3fab1ce88b06e74611924.exe"
    Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4c61050d63d3e92add0ccc4274dc05c340a6ed5c72d3fab1ce88b06e74611924.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffde67c46f8,0x7ffde67c4708,0x7ffde67c4718
        PID:5032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10837921877780620906,4936904589059770882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2384 /prefetch:2
        PID:776
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,10837921877780620906,4936904589059770882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2852 /prefetch:3
        Suspicious behavior: EnumeratesProcesses
        PID:220
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4c61050d63d3e92add0ccc4274dc05c340a6ed5c72d3fab1ce88b06e74611924.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:928
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffde67c46f8,0x7ffde67c4708,0x7ffde67c4718
        PID:3196
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2484 /prefetch:2
        PID:4148
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2912 /prefetch:3
        Suspicious behavior: EnumeratesProcesses
        PID:224
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3136 /prefetch:8
        PID:3352
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
        PID:932
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
        PID:2820
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
        PID:3736
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 /prefetch:8
        PID:1244
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
        PID:4268
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
        PID:4856
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6004 /prefetch:8
        PID:3576
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
        PID:2440
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
        PID:1760
      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
        PID:576
      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        Drops file in Program Files directory
        PID:3136
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6abd05460,0x7ff6abd05470,0x7ff6abd05480
          PID:3476
      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
        Suspicious behavior: EnumeratesProcesses
        PID:1244
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6300 /prefetch:8
        PID:3768
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5576 /prefetch:8
        PID:3964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2320 /prefetch:8
        PID:3476
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17843607515464780833,13544097784078495195,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3644 /prefetch:2
        Suspicious behavior: EnumeratesProcesses
        PID:708
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    PID:2348

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      fc4451743ae6d96d07076f3062309c18

                      SHA1

                      ffe7b073fc93cc73b1779d73528763a15c701ec6

                      SHA256

                      1e1ab179c71a268faa3558cb48f11d2c9ea8d30f6cd6b90d8f5a68c03769f6be

                      SHA512

                      c2d22f63a041d8bcd2440b89aa12f6e08b6e483a637e6bbee20e83803dc0d9ea3fb826e8a33612e5d38f55bd34e5a80961ec35ebade192fc72f7a281d2fa7ac5

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
                      MD5

                      f51c6dd850536a5e30943575e56b3bf9

                      SHA1

                      1d5cc244e51065cf5f8ed04b3bda03735aced115

                      SHA256

                      0bd3ad2546cc9471c76fb9ebd6ae75894747a3c6362cc8da7957a8816876138f

                      SHA512

                      9df647f7cbda5eafc47683ef936ec8f3033336e218e43b90c9f66331661c4224d16f8e44313a2f95b0fa88d1cad4114d914b00004ac628324e0c451e7d80a5ab

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      e1661723f09a6aed8290c3f836ef2c2b

                      SHA1

                      55e08c810da94c08c5ee54ace181d4347f4e2ae5

                      SHA256

                      a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

                      SHA512

                      dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      e1661723f09a6aed8290c3f836ef2c2b

                      SHA1

                      55e08c810da94c08c5ee54ace181d4347f4e2ae5

                      SHA256

                      a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

                      SHA512

                      dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      e1661723f09a6aed8290c3f836ef2c2b

                      SHA1

                      55e08c810da94c08c5ee54ace181d4347f4e2ae5

                      SHA256

                      a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

                      SHA512

                      dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      MD5

                      7b3f352bbc8046d1d5d84c5bb693e2e5

                      SHA1

                      e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

                      SHA256

                      471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

                      SHA512

                      c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                      MD5

                      d3e57f6e138308df4a361639bdfd6303

                      SHA1

                      b12d61c321d760079e79c0973c4933906c9fa20e

                      SHA256

                      6bd836426fed80662caa9257eff6c00d9dbe99766ee76955b457c4bf3360e76a

                      SHA512

                      322461560d47d731e3f7b5e1100afb430a1fc3a15a5d4f9b7ef9b8e214cdc379161744cae4acaaa329509726be6fa3822aed8241f10907e87e91d882ced5cdd6

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
                      MD5

                      f222079e71469c4d129b335b7c91355e

                      SHA1

                      0056c3003874efef229a5875742559c8c59887dc

                      SHA256

                      e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

                      SHA512

                      e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
                      MD5

                      242f4aefad828bbe6ff1ecb31638d561

                      SHA1

                      aa633197852fd45b40324819566d3bb03424290a

                      SHA256

                      8521fc713ae0a9cda13acd404686485228e9125826714de01a7753d5ed63285e

                      SHA512

                      6e20d5013e21406cc81f9734322eabac01f9ae047e7c67be06ef090b7e57425a01a748dd3b2b21b4066f8fc34a2c7798b92810b47c62bb98efbd69feefe2a2b4

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
                      MD5

                      c5e5a602a4807b87f8810d38b44f227e

                      SHA1

                      8aafeb56eddefd80c6b5c7b30f85bfdeb9550029

                      SHA256

                      8bf525e9c50bff27750ca3945464539de5bed481d66d7d90e56c994c50c39168

                      SHA512

                      965f3f41cdafd41d2fa72fadf753c155a89762735a2e6879443b7c66baca971364a2a97aec0a854bd5da0aec2a457b4abcfd52bcdb9c1af4b226508a1af82fa8

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638003416335661335
                      MD5

                      627eb0b592e61ca37b19107b83098924

                      SHA1

                      4de1e8b7ed207a09cc48f67d2dc8a4600109da01

                      SHA256

                      16d64d736d8f5836e9b8944539568c18fe58c8b920924ea51688aa92b1dbead3

                      SHA512

                      42448a08c3dcd9fc22edc86a76745732fe79ca9d832f9885db9d7a6539001ba8282d8923acbca05fbcd866c8792a41e7a7a4f79306e65ee34c1268ff99c3bfdf

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638001453611427348
                      MD5

                      e9c502db957cdb977e7f5745b34c32e6

                      SHA1

                      dbd72b0d3f46fa35a9fe2527c25271aec08e3933

                      SHA256

                      5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

                      SHA512

                      b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

                    • \??\pipe\LOCAL\crashpad_2280_NSKSNBAIMTLBPUNL
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\pipe\LOCAL\crashpad_928_RABZCEZKMOCIEFUI
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • memory/220-148-0x0000000000000000-mapping.dmp
                    • memory/224-149-0x0000000000000000-mapping.dmp
                    • memory/708-189-0x0000000000000000-mapping.dmp
                    • memory/776-144-0x0000000000000000-mapping.dmp
                    • memory/928-134-0x0000000000000000-mapping.dmp
                    • memory/932-162-0x0000000000000000-mapping.dmp
                    • memory/1244-182-0x0000000000000000-mapping.dmp
                    • memory/1244-168-0x0000000000000000-mapping.dmp
                    • memory/1760-179-0x0000000000000000-mapping.dmp
                    • memory/2280-132-0x0000000000000000-mapping.dmp
                    • memory/2440-177-0x0000000000000000-mapping.dmp
                    • memory/2820-164-0x0000000000000000-mapping.dmp
                    • memory/3136-180-0x0000000000000000-mapping.dmp
                    • memory/3196-135-0x0000000000000000-mapping.dmp
                    • memory/3352-159-0x0000000000000000-mapping.dmp
                    • memory/3476-181-0x0000000000000000-mapping.dmp
                    • memory/3476-188-0x0000000000000000-mapping.dmp
                    • memory/3576-175-0x0000000000000000-mapping.dmp
                    • memory/3736-166-0x0000000000000000-mapping.dmp
                    • memory/3768-184-0x0000000000000000-mapping.dmp
                    • memory/3964-186-0x0000000000000000-mapping.dmp
                    • memory/4148-146-0x0000000000000000-mapping.dmp
                    • memory/4268-170-0x0000000000000000-mapping.dmp
                    • memory/4856-173-0x0000000000000000-mapping.dmp
                    • memory/5032-133-0x0000000000000000-mapping.dmp