hxxps://www[.]salesforce[.]com/

Analysis

max time kernel
329s
max time network
333s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2023 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.salesforce.com/

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
916	msedge.exe
916	msedge.exe
4284	identity_helper.exe
4284	identity_helper.exe
940	msedge.exe
940	msedge.exe
3344	msedge.exe
3344	msedge.exe
5680	msedge.exe
5680	msedge.exe
5820	identity_helper.exe
5820	identity_helper.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
388	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	1100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1100	AUDIODG.EXE
Token: SeDebugPrivilege	388	taskmgr.exe
Token: SeSystemProfilePrivilege	388	taskmgr.exe
Token: SeCreateGlobalPrivilege	388	taskmgr.exe
Token: 33	2920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2920	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe
388	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
512	StartMenuExperienceHost.exe
3016	SearchApp.exe
5364	SearchApp.exe
5412	SearchApp.exe
1888	SearchApp.exe
6084	SearchApp.exe
4304	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 960	916	msedge.exe	86
PID 916 wrote to memory of 960	916	msedge.exe	86
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 624	916	msedge.exe	88
PID 916 wrote to memory of 1988	916	msedge.exe	87
PID 916 wrote to memory of 1988	916	msedge.exe	87
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89
PID 916 wrote to memory of 4680	916	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.salesforce.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca45046f8,0x7ffca4504708,0x7ffca4504718
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15013677668581036168,2608181787220422766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffca45046f8,0x7ffca4504708,0x7ffca4504718
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1525078198447940463,16327208243008557300,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3752

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:388

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:512

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5364

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1888

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6084

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5ae8f14dcbab790c07680d4c232a60c8

SHA1
146749b3cfeedde3da351105b7f9177935a91c5f

SHA256
66c483acaa6b4f3051b7157fcf628715b83903814894bcb7e8a983d2fc4c69ea

SHA512
5328e104bb23746bd2a046e5f56470fb52682468e7a4aa72a4cf2668f68474297213a25687c40d219880fb258bc0db5cd1b60af4f506cbdb1ea93f8cb791cb00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
04cbb6c533a3a57df8432546c4603b08

SHA1
d9d609c18614dd0b0c980763ed138f234dcd8d52

SHA256
fbe792a9721434f18b1f75f293e8d3c0b5dd849cf441b86bddb227f434a140f8

SHA512
fce51c8f8e031a37efb0faf6a93325ca2d8741a28cf6fa0f52daf7fa2371254b29962c2c2c0628f84a9ddac6fe95b98f3313df24801d53a9279aebf224e08702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
520KB

MD5
fb2e8c9b20ddec6eabe16a6a5e4076b1

SHA1
cea7bca6564497da889855d22de53b5a6cf108fc

SHA256
26b86fc9254b897ec16920c3a3f01c3fe2c0ce218f2ef5ba8dbff42fdb023ccb

SHA512
8be8fa3079e39862e168b253312078aee1adc7d3b3496f600b931099839910312c6d32211005bfae40ea8e026f4fdfc142bf320dce6fe4b4b80469472ef9723a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
185KB

MD5
a9673bd087b4e5e2cd21862f8b7d8054

SHA1
0854f56b37b3c7c3938ebdd75a79be32c94b281d

SHA256
d4226b650de255fdc92e6ba1b89181c445fa23e82e86a1de62059ffde35081b2

SHA512
3e919945421b284915da26cd49d55db1e4c5b0530cfafec936982e2b6f400e372b98df78d1f07813a473cf9f26699e9c1ffa555904d6d2b4fc819b2c202afaba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

Filesize
1024KB

MD5
98580d2c081b49f04e734c4a4ec94647

SHA1
1ae45bca31ab9cf1b7bdd4f25d21d8a9ebeea773

SHA256
ceda77f9f7f95fbc416e1ed337f7ac76676eb303a3b03023f6bcdee30704e8df

SHA512
9d5d358dfd24b40132a82ad4a1e9389c0557c071d2b2edbd5ad5c0fdeedfb23efa13104fc2b062544952bba8e443b05fba374d04d26e504de4622bac64761dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
9e8f06bf74e600099857e67819d6a86a

SHA1
77bfeda6bc39c04ad13fbbc9dabbd33350895545

SHA256
3ab9c2ae18f55bd62726b2e1da48828b2c90c4c424323e33a7bc8340b9581a09

SHA512
373331778ed942c1e86c44b5870559e2da990b020cfd8c2286487d06cbc12ce3314a41032720bca3e9e9fb8c246e518297602144c3e5db10a3704421c1858b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f7981895c91fc5f929fb6ad8d5d29d14

SHA1
cd311831513e468b6e7669ab0dfaf6a2e544a462

SHA256
73f55f36978aea2832435a49c8df1c55a4ec1b4c5fb566254ebe9e7302231009

SHA512
ed3cde099e7cce4d2d9b8f8a01aef94fc1d8f8e92e3d85c33b26abaec45323868f08c527f40c074a683ddd4c336c898083851c5cbb56206b74fc5196b1802220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9cd422353201dc31db9905bf4fa9f86f

SHA1
2a7eea973952a11761bbb7dc12dfe207aba5d203

SHA256
e1b9bb0b59365a57aec7810e7fe0b4c6cc34baff03717b817191287c14e22e99

SHA512
601a1824866f06bf241e512b5999bfd9b68ad2e22346279ea660dbd952d28f491896717a888a0fa068d71b71090f65da12cbcd793539f659e51e2eafe1906108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
24599f92ca50a72c41d97a36060884a8

SHA1
6e209d46ed86cf8c7378ff109df1869cdf343f3b

SHA256
e644870c33409c75f94e8aa6fdbb972184ff54361a8e33fe6eb72a1d8c0f3b20

SHA512
16981483f9c93029149a96894fb326dcdf483e116f953dbc3accd691a9a53c9c016f23001f4953ed9d54056ca5667292d3f6edf57434eb0d69faa63de0369646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f122c1487775a2f5822f9d95b72842ac

SHA1
77e1145e081d32d707240dd2f9fea173e12a7031

SHA256
013eda2ebfb0cf8fd34fe0389afeae0280ee3eefeb0cde4f9fc5546100e7a718

SHA512
8d132cf4a65d71deb8f45a15b9799411c9b354cfaf556eb121aefcd7bf20937333793465ac5078125e48d5b81033ac5a4d30646759b8c42d2b6cdc5f1ac68785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f122c1487775a2f5822f9d95b72842ac

SHA1
77e1145e081d32d707240dd2f9fea173e12a7031

SHA256
013eda2ebfb0cf8fd34fe0389afeae0280ee3eefeb0cde4f9fc5546100e7a718

SHA512
8d132cf4a65d71deb8f45a15b9799411c9b354cfaf556eb121aefcd7bf20937333793465ac5078125e48d5b81033ac5a4d30646759b8c42d2b6cdc5f1ac68785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8804a9340cb579b151b8d707ece176a9

SHA1
ec7f0dbdb6dda640f79ebc1fb46d543fb29d33eb

SHA256
6aad39ea08ba80868a5204d4406edab48ee32e16b9564c73116a008ba78d6781

SHA512
714f80aa1ed1d3bfe14a4212648845da95c3acc8c3a43480ce2d4541be8969b4e55aaa38fe564dcf0b89e3e2d96f1bbda034d5ff1bf150d0d50696e5fcb7a2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
36KB

MD5
0c354f07d1bcc4cce49a288cdc0281a4

SHA1
5c80fd14d7afd571be2853a360e797f90c1a72f9

SHA256
5ffdcd1e3802f3e8315d03825c580c903edbf7cf70071fe066849920151e2b6c

SHA512
de4d6ac71743bdcb1cb73492004725596aa2608d8f1b6097f0f6d01fbf20c8230ce537a822b00dabd51626a07e23f4e80349e96e8808ad103f3b82b820b846ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
a5da99bd70c1b2a5aed29a4a46e1ffab

SHA1
9382812948170891a67b168f930243aed1208132

SHA256
eae2716813799073de5e48070c2561a019560e48dd4ba4e822c2d155462f514a

SHA512
914624defa91ed54ae07150ff993f2b0b887bb9ded6360f71717dd70f8b3aa907f2dcf6e79928938cc27b6400cd5a47a4c9bb440e0a07973ea8088bcfc0b1dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
32KB

MD5
981a1d563d672e26b7684df24af6d4a2

SHA1
e15a809b7085893936b2337da21182c588015f7a

SHA256
fa8cfd9a5caadb677c1bc857a5286aac7b0eff2f920ae251720b35273790999c

SHA512
930c132ac1cea98c74458131a568dbc3bbfeaab2184ba377247d7a348b76477954b22ec5f2199b760360b3e34e74d63d4f1a5cb55c06b9c55d16b1cf86a06e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
fb50c0221bd31809adc0484b13fbaadc

SHA1
10a7c679f9886a4dc3a2282cd2269b0fa2ad0075

SHA256
9863263771ff2e23d740bb37ccf1b5b1f7a43c98f0594eeadd78e4a018086e3b

SHA512
1f3459a5e8080b99db1854cf97388cdd9ea4ef900b2d6e099dd6581059c04a7bf6bfa04d1da2ba1a963a5fef496329ff6a487dfd61834a4e599d8377fb8ad01b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
89a240d75199fff24d9b581bc086ba41

SHA1
e5153ed1b2cdaff7bbfc70491514372f13f77e11

SHA256
93cc5efd26c31dac1fd7b82d5f5818cc21f7ce006d00344662fac1127f8c1be4

SHA512
e4d467756926757db063dd3802847c877c5ece408de3d30f5ca76e56cce53d1730222c64a317c339b602b38c7bbab10b56b0488827ea72b7a2891eea99d7e36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
4KB

MD5
c20a494aa0e3b33bdc357302a2a9a3c2

SHA1
42997871cf59a4be2218e854356e4dfa58451ce8

SHA256
7430a0ced4440ff67aeef09a6f8faa062e84694531aa0df6b7533be084f1aa5a

SHA512
69919cc880d8141f968655d1ed85d1833ba10cbc79eca7a70b3725ecc9891722e93da000b44b15c9354c36f8c1a3353e80ffe1fce5a6d088b95c74ceb6499972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
4KB

MD5
18b436b53906813db27a0e000f42a0f8

SHA1
1fbd345c2ce0d2a8714aa80c9bd8981b57156118

SHA256
f7b9935446321c08cfa7e5e7194a11803158d9a77f492bf8233782a41ac40291

SHA512
9d3f79b86ce4405514759a16d717fd626ec6f68c458913a37012e9fc6377dee8171ac2bb6bbdc6d54c6b1c05df23fa4ab552fe9bd80fefeb1d5682de1b2b0eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
5c3b290c6416673905bbf5590fae003c

SHA1
3c70c1bbc303427462cb20659e6afe69a911f599

SHA256
1665bb6819c05e45b8c2a08c926bb7e9f02ace5f0716edac4893151eb256785c

SHA512
2441d847db9d991537893910c05ed2a0b236672732da03ba3569d4cb53d6255a2d75c56a893f18b8e0586ab01279d7cce23829f5dce0358d3a67f6a3e5e5f412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
9e078aba3ae24bf4d0240413bba9c04b

SHA1
d18afab32533cf62425fa74224d0f5e01d1d2c37

SHA256
28ae8309bdf893f13fe352a075182c48d46c88cfe750b274e288af7f252edbbd

SHA512
ebf03f6b64934e26ce942f4df7fcaef88bea524d4253b5a73b99e2d8f956f4acc53f1316ced2ed6b43e3ae216648a25e1423f71926d25c79e4e7b96e226a0008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f5c595289c653f72e009e44921cd6f0d

SHA1
52d3b01feedc9895f0f294eb9c1aa81a98ee6df0

SHA256
8f2d3b7a84852f7b5562fc62fb94ba1ff06d0dc7e796fa78edb700d20320ed95

SHA512
77fe929a5896dbab9b2f3b9b62b43740bba1afc5fc7801d3da11d0ead58068da85e4eecbd8b1d5529ef88f87b87c6705da55b2277c768691bab8d107aa9cd694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2a34fce44837da43dcd31b64fa8f229c

SHA1
e7e749d3e9d0119e95d6de9fbde87a23654aed30

SHA256
5d957a547f9ab10c352bda0169926413cc0eb2ac612d1b2bd23e681489c2c7d1

SHA512
9c65ee0d392be5dd49c346345bfe39bdb57b97c1d318a85790be70cdfd717205c84ab98c7136860938a4aa6421c5f29fcf2ae0103ca4892a926f8c662c25b5ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
0dc9bc05034c3762c1d3ff11827ec17d

SHA1
5dcc28fcca35d98b2e62e0ab5a2bd61a27a8fed5

SHA256
cd4acc784701e9db2204a8bf0e02e4264c63c7df266f3e7ce3c9c16b3683e542

SHA512
144c4c45981a3a759e3480584d45e0770f0e2df2bbb8f2c9bea035fd9ffae7ae7b31aedcb2c53ab6f5e93d817aa93a7d838419cfb34e9658384cba501e5a9502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
46ef2844fe8787d7aab53696701f0ffc

SHA1
96914e22ea007fae39d8468e17baaffd302b5842

SHA256
2044611630e56a6e3f3205fb2149382b0589df47432b55e5ee6c941aedec716a

SHA512
0cf3bba2242df8cc158d18dd9e406fe5ca32d5c748c6f13cf71b89b29b6c2b9a2bb83a9a471ae5fce7af358948b96fdedca7914a069c0b9f143f5a284b5e9b44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6eb8a78ad3b25511fc73b4f789f1b0d9

SHA1
f2cc8490082c7fcad7f9ad41220ea1d5b425d37a

SHA256
c6765fd7e30e0bfaab9af86d484cd7eafb57ba1e8b666dde9c0c981eb373bb5c

SHA512
bd75aceac00c0e460ca79c5eabb7006114385314cbdbae81b9ec4f5564e6c4a76112a6744c4491074ce512197bfe01765551ca44421e702990e7d931a0f48419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c1d65c9fa575c206b168f05736b0cf41

SHA1
38fad06b8800c9ebbcc0ccad0aedb46342d37519

SHA256
35a0c6050775ced6bbb3e410c876746944da8b7dfba8bb5890b5ebf280f5042a

SHA512
f7f5993c98d43a5c8e7b381897a14cf194e61e2af60090928ebd76e1ca739f1058760eb4429786f836a6f8ca7feef123035e7be72a672b50a59708f5fa2f667b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
62b8311245ff81c31b086e92080a7a77

SHA1
2f6f7f25986caa0ea863811c749bf6f0ef049fa7

SHA256
5d56a7140798828625bc5aa37b259e47ac0c95d351e6af6fafcc43835c7c98c6

SHA512
d2b8974048eaa5e97cc7a7d5ebdf75ab321d9eb6c5cb56e309e57a4388434a30ad8f31422fc765664d20a87625fe889a771fd3a7d8b85264d350064580d76240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
2aac08cd733927f3fef468520a771810

SHA1
44879baa258c769deec5ec916ae452404f86b7d6

SHA256
7ec5fef430d52e409e81a46e314db6b3a99a36535aa43fee1c49c59cb8ccbd56

SHA512
a8105285053c37d6b1e7785c3cc0f0376723ab0702e1d99852b9ec4f3016f26a5b470f95b3b3d6f99d063c86dfdff46febd491155184c035946867c5d1c4e98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9cc721eb7f40b324fcdb73f601f66c3d

SHA1
4c90cfd87c684cf1404cb8c22bc9043ae24d0f87

SHA256
931c0d00afedadab02fea5e1fa76a8897a0c8a51f8d8c3593ea32b982734ff23

SHA512
55d453bccf14f6f3ff502086ce6449a2d8ef54e9e1179d8b37c49324136b2fb347597e9c82f4a32b4a20d70905d2d58067509581668ebadea0265060022c3e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ea398cf8214eaec79f4a6ba5ce4a88a9

SHA1
eb1f62bcdb3b3b801e84c9f98bdbcd95207a5025

SHA256
e8a312e1813557c7ddca6490ed3222a37943c81f34ff0bedd4c2cd0f31fe0883

SHA512
4756c49fb5da92a6ba20f78d983e483b1b0d3963c4a3238fd0ddeee9c7ac674eb1cdb1cd16b3a4a076e54fe35236d64084690514c567d0c5ae692020663631d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ea398cf8214eaec79f4a6ba5ce4a88a9

SHA1
eb1f62bcdb3b3b801e84c9f98bdbcd95207a5025

SHA256
e8a312e1813557c7ddca6490ed3222a37943c81f34ff0bedd4c2cd0f31fe0883

SHA512
4756c49fb5da92a6ba20f78d983e483b1b0d3963c4a3238fd0ddeee9c7ac674eb1cdb1cd16b3a4a076e54fe35236d64084690514c567d0c5ae692020663631d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
bd2821c38e8a5a7f1cbe41ea5934cfde

SHA1
e70084b095aa2f89f63337e75915b95d4988ae3e

SHA256
2a99af486ca4e11ee1a076fb5abbb6f2b5397663f814b94dc942f5ee0f027a53

SHA512
eedf00f4655e18da507d1728b97066521bd5e9168f793236c2aaec7f4821ebf044ebf285cde11e95c587983cbf7276c5d13ac493dc1fedec8154bc69d7818fb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
125afba6b79966c230d0de0ff692f48d

SHA1
97797789b464adf8a264d1e01fb3985b1af3aa72

SHA256
8a667176b7f60f02352f4e71ad237996de1a67917741d8837ab30403940f0601

SHA512
6756bf7a01fd8cecf7020ad6c861ea9b9a89627c483ea7e06e4d9899dd5a669331576f6124f93d42b4e2c20b512865e45ee58b8dc58547e5638edc97923c0572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
378e63db44a5ac9f6adac50207ce85b9

SHA1
b60dc8fc3f419c4ac004730bbefd4788e91d4305

SHA256
8ded1a13080ac2184952583e74fcee62d8dd93ed3e46023c5849bad1306659eb

SHA512
0e5c137fdca30555759b36abab783495d28bd754f86fb4636fc5f8f8b83ea2d26fea4cbabca0fdd00dd463a18a3f7c98576e09a065fcc894df4aa5e07cd130f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
11cf6d30ad0e964cedf637c026524de2

SHA1
e3ae3ab7de4cbb36493ed67005b6df7381643a3e

SHA256
4269a3941d8eea6dac499e044572c16890a70684f5c75eed8f42aaab03ad7525

SHA512
87512b02083e09cc77f6d756b7deb818ecbf703d7440e93572333ab6adae53a16f6e1cd20111120904c696effae871a1e9ea9647b026c3fb0c313c0bb354bee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
19KB

MD5
e219b98ca36c3cecb8faa60f7ee08ed0

SHA1
84cfd95f675202a7b1c140b50335773c816576fc

SHA256
19cb34b5dc37901409ee52bef683d5f6b1e3f930372417d5f52d1fa89418ed7f

SHA512
580a4b154a1ab5beb37771687784bf3ef99508208cd414bbdf14a50d5eab28df7985a221efdf30cdde48e3888af4a50569e4ff66ec0c90b5c47bb638d4d4deda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
d77b7ae636ec7d6ce5c05839c13a5b85

SHA1
e3deb9196c5db71f223dbff71d97b4c4bea97a32

SHA256
f3593e21294d6830df693c0dd66e6f60ebfb28bded93f33551e8c70e891b8864

SHA512
dbe9ed1f56c63c0f00a8aac1305ff713342f724af6d915fdb616f7fbe0c6f7b5ba4862cfadb28e39dc28b556e8cfbe348cd4e25502e29387594b3a73083a051a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13340900684500293

Filesize
25KB

MD5
f36bba7e3a3643d6a5ce6c34e93dbc43

SHA1
fd12cecb006e3a4932f7589b31dcdc1041e551fa

SHA256
a6f9659f7f87021c0cdcadee2fc125b7c5ddab241cf2550f4778fcc1e8c9677f

SHA512
cdec67530f6cefc9d9b91e6c3b69b1f24b4c8fee233f70101bf4c86812c9241c60b6600373694ecabc11db232e4f6e1fb80e8feeca47af5a8db77b11b3a11ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
328B

MD5
4f28bdecdf66b61145dedd6a7f934eb2

SHA1
14d252948d78a5a6d6f8ae133469c486874740c4

SHA256
abf72608f308c30c6e5f130df029a54141ec2b27ff815fbfa6a7296e4eec2d56

SHA512
a4c316cfd246d79dc150ee0e33c33755cb8010ba4e163800585f510a36f0f0c163fc1dd34830f95455d41353aa25c1ca3733b4a1cca3dc528b7941defbcadf7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
68fcedfcb692edb80cc0b9638ec0ebbc

SHA1
39376620c826085667b3b38616fd2d03d1150e63

SHA256
a828febcda792054a880286a52691a65a6b4ea15b1940281034eb8dae11a6d3c

SHA512
2683cef08b57ef25d2b8d0a048bef7f2e355446ddf34acac492feeb7d8168ecffa85b4dd2af7e6677461f54679528d3cc360ace1522b19cc5326b42d5fdb7e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
bbe2dd60bf96f635112f09a60cc39190

SHA1
c1f47ff1d5d60179a441510f6faaf826d45bea88

SHA256
40abff5e18c7f3706a0956a02802f649ed0d0969e5e6c3552aa1227cab7fbb13

SHA512
0fa832f8e2cc4406c56748cdb717fa7967451ea54fb76b9608d36356252970553b95622037ab592b8cbace3d93a085c8acdea5689791538fe8f7b60ce58af76c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
267a6be85641f7d7c2933b7fa5e043dc

SHA1
622c315756956c1044945eec00bf11442bd01a0b

SHA256
5cf193516173d8f22fcaa6eeb846daeb8cb0198a7b46e43473f800985be42a8e

SHA512
10b77e5bd93d81cfcfb5a80ac19bacc6caa33e0caab281cf3e208864046af3c1d65e2bf9b4e385b12d720fb6815981e9919cf4170122ff95b727e2d146d3b717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
83d0f02ef48b667eb3ec6a4e475e8487

SHA1
3ebfe820ba1880c6e1474b7069d9a02fa1383c9a

SHA256
078f4fee1f2dbaae8da291058d765243e8f58286c6d117e77d48c6a5a75ad1a5

SHA512
5a6a6e235f4b7a2d1830d6feeb83ddb693bcfd995e473fb249d08a9f5b459c17d64dee48c52ba0cb997dba8941b9292fbd8c31a12a2668edb34317ac176bf0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1fd5b1dd260f1403b4fb08616fcfbde0

SHA1
cf885100b637032cfa78f2cf8ecfc8fe4a9cc405

SHA256
0520e41ca745564b9b22d137a69bef0e6cb7b56545c0c652c46996e08501e492

SHA512
d54e15b4c84f5f85467255f7993ca819212cb4592d5492473d5b3256a9477c608386d4b885d1054674d098209f164830ce6ca20af44dbc5ff910cea35f29e777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3d018aa59b1a0e5695b9b9f1e43ed8c7

SHA1
7d9d98e99d962977b448fbd7e1e4c1c0ff5531ce

SHA256
f8882b8bfc5f0efd05ecb1e8054bf1dda35ae1144a9deb89c1c19a041882294e

SHA512
ce1075b356807cf1ae6cf655149d6f6f27ae2ece5240170362338fdea4098f52dfc1300ae6e694a13ee8d9a2f9ada067a745e1227afa66608d4624fd976a0724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2aa260a8dddb52be3d1c6d57bbd8abb9

SHA1
2735948bc2bb078dfbceba48cd156dbe0c83a88f

SHA256
638f2052ba0a06dc6e239ef82c13abb78d62fd3c4cb1e0c965b698ac529a7830

SHA512
a158ab5de9cfadb631e20c84103516a2434ec3204e8cb4f1a6a1d1058de0a857ae415e473626d231291d0cb2f42a9ff9b917c78a722ed803d3707e15be219464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5ce54626067d8168acf4744414c76955

SHA1
7c81de0ea535b2d7a01edaa5aeb76380fbf36128

SHA256
bf13f288dc0908217271614fb9110268e600ff0af8ab9bd275a2313ebac464cf

SHA512
56604f505c6aa5df695ec440d9cf78d0d32c01dac1bbe2c44dbc0a2742004806ed13a7d3f48ab54ca8d31cc10f4416b7b6c3faf2b5df83afeac703e00dbf8dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
335c718cbfbf0f4a4edc81880cb941fb

SHA1
ca61dfeedd447c98af87f9f0815b08647650760d

SHA256
f7ec7858861a01df6ef25ec7e00d8bdff26559e57ce864c5f32edfc0ab536b64

SHA512
ad339787ec2e39333a1844a27d6407f9fe05bfb860d46ad0e9c0bd2399f99933c31ac15442d5686d90386b176cc08138589863810ad34051b37078e39d215f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e54f.TMP

Filesize
2KB

MD5
b80cbd107f92c7c04f0118dbbcafbf9c

SHA1
51a3675778f64b6fffb64033f72498f7059d1dde

SHA256
9d9ac1b9425ebe9890970af34feb0f81feebcb0efbc8b94886b886b29a5d7aa8

SHA512
e358e86507ec6f4f0a27ed47e4d9cd219a32ce1d1acba195e39a0afedd806def693b8764947b024dd4555706011b2a6a4b12e944605e39e70a18c979d3d5af29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
bce0a917f7db0caf8381040975232bd0

SHA1
e7234fe41f8f427fae041bfb729fd362e47c5375

SHA256
e362820771c7e968fedfdde9f811c4fc82de8ed18e2f44c0057c83c286e410b9

SHA512
8367357dcb788ad3b6296e982c0357bc66a9df135b5310677b5f3f8fd398f318d125a8fef49e550d034a78057e1c03fb2e078fbb48ed41f6fa2ff4ab45763c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
1dd45f2bb29e4a7f050c90652e00d57a

SHA1
7b01b798237e460530da771b00ca1fecd462ec92

SHA256
113a94b0b8145e6b193dc40946695ccb0438b97851ce7d909fe7d5c5b7659b2f

SHA512
87cb2bc370936138febd1335fbf17c08cf4a425e1120e9c5b001413d11f2cf9959d7b62e234cb06e68dadfcd39e9ba1ca9f11b37a9e6606e1e075cff7d4fc14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef0220c9-54f7-4f17-9642-bb6385b4d231.tmp

Filesize
10KB

MD5
f0ba2ced83e1d7a052ef35b3e57a3992

SHA1
6abf1041db8533b81ba61c710cce4f9f0940b493

SHA256
761b58e31ef8427a090e465dcc06cc4a565527afa203e2d6ee09249a5051449c

SHA512
8d36a582ff42d750c8d2c2f35b2d37cbde718d595f7fe70c02f58b6f744b0d8f37e4ead7d8b8d8eb2946786427c42078921a7421e68af3341dc300ce7375c0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb5be5a6-c17d-438c-afce-beaa6b829aeb.tmp

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
116KB

MD5
32517fed7ec93027d50c08f4be0b7b29

SHA1
fd6b134b4efe2f089f0ac9d9704536c61a247077

SHA256
f6f9d1431b48db3442ca4c406a2fd1ac3133614f637cd54713d954b009114098

SHA512
839573a8423dfd3b008911643271b9f6bf670e67ef18060c5e4c85f89a3563d4a152d164b6689bc6dc7dd271c9cbd5b4608c8a5e8e992767b3833ce0097aa1e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
206B

MD5
cbea63fc18a1b2491658fbabaab47e76

SHA1
ac7fbd662ee3c36bd3d75b304eac06d706ccb7a1

SHA256
b1c4c100a4263ed2c72dc893ae82022c1930624a0b062afc7199706ee9b66c1e

SHA512
0e953a281eb13dd51bf410103cb8d2a5514dfce347d803444bb95838f07668fb628d8d7c354e19c01d46d04386026dd2821ea119d725da5e3933925d13e6e2ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
f369454d7737f87f8aecbda4835d1a22

SHA1
ce26fface1a8cd08b5c6f9942c6e706121fd4838

SHA256
90f5559910398088624166cd294567f2406782441ca7358272f0f2dd8025a6f0

SHA512
b13c52d5ab81e41e55e775308afa1813e6cee44f1e8357c2e7b59786b85b406d2d8f22ee02bcf1e2eaf568f16b4e89b040499ae6f0c83bdab507d085e4042f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
c0c89538761c10d825644041d4e38dd2

SHA1
2f701198f57e38b115585993e786990862aa5948

SHA256
274b22a5fc436f5c44bdedc2d4032d734f0c303d1940ec15b24e65eef0eb935e

SHA512
dbfcccfbfbf12a44cf78ff2d4876b7836c7288025cadf64f371f40de679057a26fee356b278efec6306defcbd7cf52e7e40d14b54bb9f4477cb46c1cf6e8d0d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
7d8940978f201fb611ecda2fe7dc6362

SHA1
dc133d781e258992fda7a4b7f0d7862d98076f2b

SHA256
c594522521b17ceaccbab7138e2121e57b450fa8e366815bb3292b3f0b01d606

SHA512
41a5d2d1d8fb5cabd5bcf285df96f311846a3d594def425cfb4a83a305516543f6eaa64d3946f58c036eee62165ea6c66747f7ee3f29efae4ebefd0bebef4954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
338509343d05495eabc7ab1bd3a4e471

SHA1
e4b1c00502c9b485e9d4c85161db0682ae567236

SHA256
b98b1523f93b743b5b8e9a9cda2c9afc204c4fdf94e272a8618c27b509bc1858

SHA512
0e2d614509242b9681e097586567bce5396c3ad487ad7369437eabe9bc0bea779a37e072edcc25e98fb31fe61b608322629f528b6b1dc64162c063b2561a9b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e50055dbb71bddcbc12520615cfcb55f

SHA1
b0e1e2d201883af6b2480722a90140878e476049

SHA256
2dc563a0efefde27d6aa51b68e07312d360ddc2be20b7c2dcf92facbe007f375

SHA512
dd557644382b318806f00de528b1fe953e88826e2b43f4ff00490695e3190dbe294d428021de318c6d862ab116aa5e0869d00cea786e436e173aecbeb52e3a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
21209f1825f1517b6aed6a30c006804a

SHA1
2a938a331b4788e307461f768de2ff21fec8621a

SHA256
090485fb270223eef7bdeba74a9b13a101a1d2094f569da381375b01ed90a73f

SHA512
f8bf4088c9b0be3a18d26ce6d00027fe86290cc0a01b71fdee5cf6509e7ed5554dcb8bb56e8bea7698d2c49dd015bf03a66b02e807cd77502c5fc8d4c844bf8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e50055dbb71bddcbc12520615cfcb55f

SHA1
b0e1e2d201883af6b2480722a90140878e476049

SHA256
2dc563a0efefde27d6aa51b68e07312d360ddc2be20b7c2dcf92facbe007f375

SHA512
dd557644382b318806f00de528b1fe953e88826e2b43f4ff00490695e3190dbe294d428021de318c6d862ab116aa5e0869d00cea786e436e173aecbeb52e3a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
b1e3995ae35f5b0d2313895344a451b9

SHA1
c583f104f82bfae53d5c0da74d0004fc8e536692

SHA256
315e66f2272cb44e82c7e1ce8ceb319397416f8b4c1cf39cff951becb91a57be

SHA512
ca1635517d581128cd663f261a2a9864078108b75702b850a80e266dd20f785307af75a3968f0df38f7bafdc71f87ddd1eac4d42d52f421d928a5a37ff8e5903

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml

Filesize
97B

MD5
82b066a0c26e9c3c026d421e012a093e

SHA1
2e4493ff239034dd93befa48a286616fa1222526

SHA256
a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

SHA512
4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
7b424d7e2ce01cc6d416c49e84d432b3

SHA1
61cfbd6300fe4add7f85541e9c56057b7873d5ab

SHA256
711dfd1d3ca4b760be3215be6f19ce4762110fd7e2025541a1b371f8eca9ba9e

SHA512
1b7f869df8478d48a376b6c85db389339f90908c007dfc61c5351320a383fa092e3133d0d38f061f96b20c58ba92fc6172b9d51f3f051773fbb10791b7aaabbe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f0f405bc08f238f86487c67027d72f85

SHA1
4f50310f4a9bac33976d0aabcc7300d6a64884e8

SHA256
09a7c353883f7699ac59c4bddc6c4ef2d960fd06701abf657ceea5164236a58b

SHA512
5671b17cc8cd12c08181fb9af0b5f11029455ad8395316a322488a388a395209bd689eaabad25af07709f2ae49f5bb874e6d35a9cfa586ab9183d3d0826712c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
19ecfbb0ada2df8490475325d3b7604e

SHA1
1f231560b68989f151a894a6c70158067c76b1c0

SHA256
bc8435ceff76f5a7abea78f3202ff13a80794599b074499e671dd8df3ec1cc5b

SHA512
6bcb7d69b0f809f35f3e7df47f70729666e0891d6be1e555dc0274090c57485b8435c59f2dfced35eda59a14b55fb648f333a62e140326ec4b6a06ee2c4e7352

Download Submit
memory/388-1170-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1160-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1167-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1168-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1169-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1171-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1172-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1161-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1166-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/388-1162-0x000002A531820000-0x000002A531821000-memory.dmp

Filesize
4KB

Download
memory/1888-1263-0x00000212347C0000-0x00000212347E0000-memory.dmp

Filesize
128KB

Download
memory/1888-1269-0x0000021234B90000-0x0000021234BB0000-memory.dmp

Filesize
128KB

Download
memory/1888-1266-0x0000021234780000-0x00000212347A0000-memory.dmp

Filesize
128KB

Download
memory/3016-1207-0x0000017DE2DA0000-0x0000017DE2DC0000-memory.dmp

Filesize
128KB

Download
memory/3016-1213-0x0000017DE3170000-0x0000017DE3190000-memory.dmp

Filesize
128KB

Download
memory/3016-1210-0x0000017DE2D60000-0x0000017DE2D80000-memory.dmp

Filesize
128KB

Download
memory/5364-1231-0x00000218279B0000-0x00000218279D0000-memory.dmp

Filesize
128KB

Download
memory/5364-1229-0x00000218273A0000-0x00000218273C0000-memory.dmp

Filesize
128KB

Download
memory/5364-1227-0x00000218273E0000-0x0000021827400000-memory.dmp

Filesize
128KB

Download
memory/5412-1249-0x0000025043260000-0x0000025043280000-memory.dmp

Filesize
128KB

Download
memory/5412-1252-0x0000025043670000-0x0000025043690000-memory.dmp

Filesize
128KB

Download
memory/5412-1247-0x00000250432A0000-0x00000250432C0000-memory.dmp

Filesize
128KB

Download
memory/6084-1279-0x0000026D78A60000-0x0000026D78A80000-memory.dmp

Filesize
128KB

Download
memory/6084-1281-0x0000026D78A20000-0x0000026D78A40000-memory.dmp

Filesize
128KB

Download
memory/6084-1284-0x0000026D78E20000-0x0000026D78E40000-memory.dmp

Filesize
128KB

Download