hxxps://santander[.]de-system[.]in/

Analysis

max time kernel
358s
max time network
362s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://santander.de-system.in/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Applications	crashreporter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Applications\crashreporter.exe\IsHostApp = "0"	crashreporter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Applications\crashreporter.exe\NoStartPage = "0"	crashreporter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Applications\crashreporter.exe	crashreporter.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Applications\crashreporter.exe\NoOpenWith = "0"	crashreporter.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\MuiCache	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
3164	msedge.exe
3164	msedge.exe
3496	identity_helper.exe
3496	identity_helper.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	firefox.exe
Token: SeDebugPrivilege	4468	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe
4280	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3412	3164	msedge.exe	90
PID 3164 wrote to memory of 3412	3164	msedge.exe	90
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 3316	3164	msedge.exe	93
PID 3164 wrote to memory of 2676	3164	msedge.exe	94
PID 3164 wrote to memory of 2676	3164	msedge.exe	94
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95
PID 3164 wrote to memory of 628	3164	msedge.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://santander.de-system.in/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffb46d246f8,0x7ffb46d24708,0x7ffb46d24718
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,9524795460132385411,8473998619395257268,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3832 /prefetch:8
  2⤵
  PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb46d246f8,0x7ffb46d24708,0x7ffb46d24718
1⤵
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x94,0x128,0x7ffb46d246f8,0x7ffb46d24708,0x7ffb46d24718
1⤵
PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4468.0.1141296478\1064454536" -parentBuildID 20221007134813 -prefsHandle 1792 -prefMapHandle 1784 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb2ef91d-9bd4-473c-a07b-538800c6cac7} 4468 "\\.\pipe\gecko-crash-server-pipe.4468" 1904 18928706658 gpu
    3⤵
    PID:5140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4468.1.72114720\913375653" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2336 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {854e4afb-ed66-46d7-994b-4375a3ac00d4} 4468 "\\.\pipe\gecko-crash-server-pipe.4468" 2360 1892703b058 socket
    3⤵
    PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4468.2.1142883061\558542388" -childID 1 -isForBrowser -prefsHandle 3244 -prefMapHandle 3352 -prefsLen 21012 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a59e02cb-e68f-4d35-9d0c-e30d8dafd477} 4468 "\\.\pipe\gecko-crash-server-pipe.4468" 3240 1892b6ab258 tab
    3⤵
    PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4468.3.704009906\477634185" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3472 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c83edd6-6faf-42f3-a5c6-b2110e7ac52d} 4468 "\\.\pipe\gecko-crash-server-pipe.4468" 3708 1891ac62858 tab
    3⤵
    PID:5736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4468.4.729387860\1012275247" -childID 3 -isForBrowser -prefsHandle 4868 -prefMapHandle 4864 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d546abef-e743-4f23-ac4f-1aedeb2ba7ce} 4468 "\\.\pipe\gecko-crash-server-pipe.4468" 4872 1892d6dff58 tab
    3⤵
    PID:6020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4468.5.1218195166\1123794744" -childID 4 -isForBrowser -prefsHandle 4796 -prefMapHandle 3680 -prefsLen 26921 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d111b11-7366-4d9c-b992-c2c1835982b5} 4468 "\\.\pipe\gecko-crash-server-pipe.4468" 4084 18928aa1658 tab
    3⤵
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4468.6.1616056099\1319500224" -childID 5 -isForBrowser -prefsHandle 4772 -prefMapHandle 5276 -prefsLen 26921 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b23f5bf-8f79-48ac-a2fb-518a52a4636e} 4468 "\\.\pipe\gecko-crash-server-pipe.4468" 5080 1892a1c2558 tab
    3⤵
    PID:452
- - C:\Program Files\Mozilla Firefox\crashreporter.exe
    "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\minidumps\0c81984b-94b6-473b-8ae6-7d8a85c6f006.dmp"
    3⤵
    - Modifies registry class
    PID:3796
  - - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
      "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "--full" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\minidumps\0c81984b-94b6-473b-8ae6-7d8a85c6f006.dmp"
      4⤵
      PID:2320

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0ec3dcb7412fecec04bc76269a1c01ef

SHA1
e219775ff07b744c3ede4b5ec5855e8dc531ea54

SHA256
3cb776acfbf9de65043b9fe841480dc3e410c1effa50676b13976c6f23d9453a

SHA512
9637e7c646ef6269bfd0859721b2ed160396a8dac33e2c6e2f3fa312b09be4b3bccdf0e0feed2931b3b07b52bf0e5ab5401f91bfea8fec2a725e32d65f620210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
fbb8c44200cdcf327bbf52b67fd03c89

SHA1
bdecdccdbd3b8e973bf07b3258afa4bc0322bf40

SHA256
1e391e0b589bf281215835f6856aafa0048a381a59e09a2552de7aad4ffc67d4

SHA512
3c0583a9f881472a3457fed0cbaaa78b540545dc4b63aa6af3fc9761242fd17b9bc3a05874d996ef238d1feb8651e623c0080b5868abf3009567c39166727d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
659B

MD5
f220129c275912136574103d1a567051

SHA1
4c4011d0e863373353a7b17683dc2570a18e74c5

SHA256
6b951627a234dea756da02d6bebbc7ab819a30b3a2c4b26d683fb67f5e0c929c

SHA512
e2102f0979559512ae5ae3298986a934e5a70dfb90e6b6c7bef09bcf56105834d39b46d3216d133f40d50ef20d84fe36cc3719cd04509107d687f4dff13f7d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
789B

MD5
51fa2762501630272fe8c7ac649e1809

SHA1
e982e1c6fbe9b8215ad52d7c765ce01edf892da3

SHA256
a5991c61d88eb2a0b46131547e2ba3e82fbe1f84620026701bde4ee2c7a156c2

SHA512
4079ad23780035075685e6607b167923dce5cda9391e7eb4353413a1680f8b413bb548518c7bc67b2a91456c3aa7293bf2a9775ce0e6bf7dea227c1860cd0e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ecd831a035ae7cfbf05aa7321a3da4d

SHA1
63bf9390c9ee9762bc823dd60ec1ad5e920b21d6

SHA256
ad17cd5509e7519f997ebccfb67cde77453bdbfe10231d815308008baab54cb5

SHA512
063bc06083464ee7f8d62e2d542cb28f8b3ac2c44e8a97ef78bda0f1be76324abd2d3259419e0632abcac4d972ffb01f735772f793d6075bafc63af9f5815402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
159d1d1d481e97f1cae478d89ada24fd

SHA1
33fbe4e886ae5fff087348bd870f43a6f96e4199

SHA256
e9d67243c22da26009cff67b646396383b2e744ed2513c51781e8e8f07f29f10

SHA512
a7e0ed5d1cc5d61c391fe8f7ecd40817e6076632379a2fb64ff46f53809a82638455daf15ebfadabcf08cecd39648417fea0d92143d30380737df35b4bd82f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
563624031e0fd79ad12fe9d38ce2d59d

SHA1
8f7a89e66af3e3223e0a96ce8a08e7ddbd2e5d57

SHA256
31d71400716909db9e4aa7cb1dd7dcc1366c78757cc41e5e927e4e9e67acd3f7

SHA512
cda6e163c799bd0b6920b7e81dcbcced2c73020032f5f1422e11fc4115dd594d4dc2a27ffdcbc04f3e7d20fd9e5c303ba6c3cae2e276328eb27ec5ce9017611f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
d7bd4d52a251026652ac30c40888cefb

SHA1
c9f49e49446f68439e4a422399910bf6aa8c2204

SHA256
ce7592ed7ddb02528a4e7f3b0faf21b43fad50a0b9324a597484eb798179266d

SHA512
5870cbff9437c530d298c4c1ee395a1c41359c131ac3891865c7b23f9afac10094fe7e4e43ddcc4ad8dca7b03fd9b37dc2361b91892c7939cb78c58d703990e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4af9d3cf3bce9d2d44f0615a4b73c85d

SHA1
477f208623c9be974f4cf62399395ac36af1810b

SHA256
ea8820fd660f419231b603c180c701ebe7f0e2f2333f9e8eb682e9f0646a2c23

SHA512
9e87d27af63e800afa3b699e3454db878a5789cd63b0a76fb882101c472b95acfde549c12a3ebbe05e2d73d660ca16b0af4f1a1b1627d52edda2212aa070f87e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3bf2f20a98c94a1b00c39f44dde20da9

SHA1
e174665180eb94a9eff8d0a3c1cbca7c65657ef7

SHA256
b5757a2105280cac28cd181d0c7fae011fd612cf4d4806ea1962a41a6d2baf0f

SHA512
b56a264a4d94d4f03df2786d3ef34cc5d52825298bb5bf2ff649604d768479c15ccba51081b5c1248c865f8250680af9e238e023529a5ec819f40a59dca37089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
80f7088f3e81eecda9ec9328f4f6943c

SHA1
5ade5b76dc286b585352d886e42d59efc8f25303

SHA256
9ad4ab05a78e38a717d4b466a3b05f0306032726d424a479b7a82facf3199611

SHA512
05e97f412b74a237cba03c0d974bb58e49e91768c793d3f7e9703cbcf0d26e3dfaac0fac9d172ccce677da1e57b415e3bebe41a7d7a536f497cc62fc0160b1b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c5a8e8e5edc6364350a306eed1e2513

SHA1
ce939c39d5672700f9fc7dabbf5818fa812a2941

SHA256
de50cc7783ce34bbfd866fa80caadb322a5d45dafa9c578e3f2f77cbde412657

SHA512
c3e6fe50cdf6edb9d4d1985c2330a8254b158c754a42fbbb323b5082780e0b250a4e58bd61cdd0532d93b98046581d32a2a2dc869b4376d132e7d1bdb1ff4043

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\04pqhkp3.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
5e489b39aff9fe3367b5764789fa9d84

SHA1
248dec8393bd256f26e5724a0416e0b643234f10

SHA256
0081262715b2beb4ef4b21aed79df308d80c76a5048d8beddc2a588b121e8dd4

SHA512
b0b62f6b4b44ede2fd4bfa13fd7e57416ed7b54f41d99e126007a076c0cfeecb58a034b5eafd73dfd6e025ec32599fda2bada67d6df70c9729b6078c2c18d761

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\crashes\store.json.mozlz4.tmp

Filesize
5KB

MD5
0b167985375530e1039bb16043dda795

SHA1
4da9926a42c60c54f0f823f64ff30a90d6954579

SHA256
b44cbf9051f05b8f3a2c9d9601b44a16e362d8ccc3182394878613619e35ba18

SHA512
43823e2eb154cae777220d28fd815e0d5dd963ff5392fc09840cd969b49e2245f4c81e3217647e19bbc17c205ec5a971dd3cd758eff0e346de68c554c5c4de03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\minidumps\0c81984b-94b6-473b-8ae6-7d8a85c6f006.dmp

Filesize
541KB

MD5
bd4a1ca94124b823c624b93e3c166989

SHA1
33abc28dccefdd07df1517a08f04e65b20c93905

SHA256
bf8a24092ae0518a02c4ca1fa1d4ae5c32e011f6fc94d7618174dedbd215e27b

SHA512
f8b4f570c911385108b83590ccdd5d5c21e842c2e7e27bde9a1389fedecf727fccfdbc5762da84924373c817c3b6f149d3e6d2551ddf96fd02894433b6f0ba07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\prefs-1.js

Filesize
6KB

MD5
9444a0a4d2fd12fe7af4d42a024001ba

SHA1
4b667143f239eeacebd5ec975dd5d7dabf6a74c0

SHA256
13b7376400b316b6a48b7ac2f5d3b26b9b40712a1c37be23c96cdad03f812037

SHA512
fe7d76103a744f5daedcbb642ac717f6a503d2e796731521bfcb7803bfb1c1f92464141ca9a4448a9816e60f9c0396bd5da1108a15e034f4607da1f00261e68b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\sessionstore.jsonlz4

Filesize
917B

MD5
82b03e6f340ebe66624cf8615fc3714a

SHA1
b07fa70ae39ec482259cdd3e1d2a8f86678d6391

SHA256
c82973324d0ce7534028ad8167deb15df37c9fdb14ae74d3d88a4bc84e200b27

SHA512
1d37a88c961a5655119534450603bb6e3202b73cf25cd89c2039003b760e93fc15a2c2d53b35e093f382d95d72fe958fd32389c1fd03e3b75e77cde6df44f35c

Download Submit
memory/4280-237-0x00000213F5200000-0x00000213F6B2F000-memory.dmp

Filesize
25.2MB

Download
memory/4280-277-0x0000021BF8230000-0x0000021BF8250000-memory.dmp

Filesize
128KB

Download
memory/4280-276-0x0000021BF8310000-0x0000021BF8330000-memory.dmp

Filesize
128KB

Download
memory/4280-270-0x0000021BF7F00000-0x0000021BF7F20000-memory.dmp

Filesize
128KB

Download