cae59ac7dd335c3335df6db66f1b65e49c656efe73910bce533e810c5b2f6378

Resubmissions

26/01/2024, 22:19

240126-181g8sfea4 6

26/01/2024, 21:33

240126-1elf8aegg8 6

Analysis

max time kernel
2038s
max time network
2040s
platform
windows10-2004_x64
resource
win10v2004-20231215-es
resource tags

arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
26/01/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

installer_vst3_64.msi
Size

2.4MB
MD5

d1c81d2b8a9ffc2a86bcd2c5208350cc
SHA1

6dd7bf80a0ba2fe237f116f10f08674322c694e8
SHA256

cae59ac7dd335c3335df6db66f1b65e49c656efe73910bce533e810c5b2f6378
SHA512

3bdb0a2593ad39172e44fe351775c90c0da8e6c2f89029cb0617aa34d810eb5bb32952c71e51b69517616c11f019c983ee44e789cff73d03353f982ee0039ad8
SSDEEP

49152:nzAy4xMrGBAzYOA5SuCEcOoYIAjubjexrXgj:nUjMrsAeSu/cPYIAKqrX

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	4740	msiexec.exe
7	4740	msiexec.exe
9	4740	msiexec.exe
11	4740	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{9B0FF0CB-9382-4AF4-B1E4-42F77B2F5BE6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
3600	msedge.exe
3600	msedge.exe
4836	identity_helper.exe
4836	identity_helper.exe
5008	msedge.exe
2340	msedge.exe
2340	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4740	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4740	msiexec.exe
Token: SeSecurityPrivilege	1824	msiexec.exe
Token: SeCreateTokenPrivilege	4740	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4740	msiexec.exe
Token: SeLockMemoryPrivilege	4740	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4740	msiexec.exe
Token: SeMachineAccountPrivilege	4740	msiexec.exe
Token: SeTcbPrivilege	4740	msiexec.exe
Token: SeSecurityPrivilege	4740	msiexec.exe
Token: SeTakeOwnershipPrivilege	4740	msiexec.exe
Token: SeLoadDriverPrivilege	4740	msiexec.exe
Token: SeSystemProfilePrivilege	4740	msiexec.exe
Token: SeSystemtimePrivilege	4740	msiexec.exe
Token: SeProfSingleProcessPrivilege	4740	msiexec.exe
Token: SeIncBasePriorityPrivilege	4740	msiexec.exe
Token: SeCreatePagefilePrivilege	4740	msiexec.exe
Token: SeCreatePermanentPrivilege	4740	msiexec.exe
Token: SeBackupPrivilege	4740	msiexec.exe
Token: SeRestorePrivilege	4740	msiexec.exe
Token: SeShutdownPrivilege	4740	msiexec.exe
Token: SeDebugPrivilege	4740	msiexec.exe
Token: SeAuditPrivilege	4740	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4740	msiexec.exe
Token: SeChangeNotifyPrivilege	4740	msiexec.exe
Token: SeRemoteShutdownPrivilege	4740	msiexec.exe
Token: SeUndockPrivilege	4740	msiexec.exe
Token: SeSyncAgentPrivilege	4740	msiexec.exe
Token: SeEnableDelegationPrivilege	4740	msiexec.exe
Token: SeManageVolumePrivilege	4740	msiexec.exe
Token: SeImpersonatePrivilege	4740	msiexec.exe
Token: SeCreateGlobalPrivilege	4740	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4740	msiexec.exe
4740	msiexec.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 5044	3600	msedge.exe	102
PID 3600 wrote to memory of 5044	3600	msedge.exe	102
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 3420	3600	msedge.exe	103
PID 3600 wrote to memory of 660	3600	msedge.exe	104
PID 3600 wrote to memory of 660	3600	msedge.exe	104
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105
PID 3600 wrote to memory of 1596	3600	msedge.exe	105

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\installer_vst3_64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe1b9b46f8,0x7ffe1b9b4708,0x7ffe1b9b4718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,3118544374283562989,10385234925554310043,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b5dcded-a67f-405f-bc4e-2fc75deb1344.tmp

Filesize
10KB

MD5
dcdd81072c3a08bd9406979863d1644a

SHA1
5f96f3f44c281ae4edf200d640f83a20beae722e

SHA256
a6a58e018344115696d6547401f8f88751d2384aa7c753546bfcb4d16a7cdb2b

SHA512
0655a13f0c01340bc4c1496745167e4bb0b66233fc500faa1c224f01f011415453f8b5dd6b0239b3d6ebad49ac4a2bbf2b7a2efe29a2664bbfd5548ff6961f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
193KB

MD5
1794388467a5d69cf386bdc803cf9390

SHA1
71e89c7afd4059cc383091cec62b84da31ed8cd7

SHA256
8a0b86d60e0dd4fb9a6d994ebafcb1c8614dad44dba85c33f46ac982558edc75

SHA512
d7781a21bd8164b94c3464ee0cdf5b4c6c7cbc079acea9c50baa9dbfaeef27ca315d4aeb9491571608d611477d94c64ac5abc31fae8e72bc1a6d5a58bba17d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
26KB

MD5
7ed7d635d0f5215a32a393202ea7a628

SHA1
e04d5867f3a0dae63633baf8cee4c52e95ab964a

SHA256
ae7f7fe9b62a9e6b7acfeaad4884a0873e08430aa25183bdaadd5949b5febc00

SHA512
deaed4a0687981945e4bb0aeb679f806bb45ff33fb5e2524e5c2f1c88db75844485770498c552eba6f31e7debdc9c816bc846ff01ce1ef0cc6c7d6d23ee041f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
67KB

MD5
7d34fe63af259b2b36521fbc0a6cd2c4

SHA1
cc335553f75b135fd74f5f4e4e6d1456a6a93a94

SHA256
fb5668817ab1e91cd62ef40c6f6545a4e27587374dcb112d72b777ddaaf6d4e4

SHA512
ca66513f3a1e725013da052ef236af9b72c7760b6e743682754117792b8e29389abe4850c91d97ad08a7b9aa506398e8152ea52fd2e974ebb79fa500ba809e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
82KB

MD5
ac5195108ffa3c8e98a9de0576f61b19

SHA1
a17d81c55eb35403291fbba122059e2a5f79b218

SHA256
b876acbba780764bcc331cb0fee51839f76ba3f97c75cd24c7d0444a95b7cb24

SHA512
8f89c9ae9a02f47cd3f7e9cbe1dd720ca17264fd3d3acbec69adef25f0f28ba97118065c19b45a20ac091f2b243341e08f1b097a50aa27e2805e97b073a818c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
16KB

MD5
ad4241b8e34336483c8b316fd22ad1a2

SHA1
5d31cf73ee6bc8b77b3bde324722efb44a04ea79

SHA256
3e942e7209f7e4c2a2c4bf261dc71946e1612f670725c892661112f672bb5f66

SHA512
2db15e7b98ba50ac1c7572539052509dc382c68528f4ee4652dbe61da07f513459e719e474b000f3961cea90c325d6ecd34a8305d90299b285d267a2abbded61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
8cbd21a61b9c444d9f748014914eaace

SHA1
20f1ddcc7d941d13e8e69e763c419e2e4e02b9a0

SHA256
23b34fe30fa0c068ba81d77d1873578c3651e09f672191df9f8554399ab00d5e

SHA512
43ea7a1e3aa4dd3b12ccb4c7caef63510bb93dc1d1c16917b08f664ea7203e3a25be897eb2e2c75b9211621474e383cfb726b435bee8ceef0ec314128e9bdf07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b7d7180f0123453bc0bbb15b94f9bf93

SHA1
8a65631b4cddd550e8095461e16dc1f0cee35196

SHA256
6dec3798844a3487c8a1c0fb0cdd772b7ee81806702d40eec266526a2c6115e3

SHA512
3eee14acc2f6d42e7dc2ed5c5f25c821f73b6c5e492ca8b21f69ef446cbaf86bdeefc9ce6b5e50c9f5bd779f9e9c12a5024803884abe2d5ee0e25e4671870400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
09095b99ad2f177404943d3900c34ee2

SHA1
661854a1b0e9840eae081da9a94bd489fd63da54

SHA256
ed724eb36a080f7ee133ea7454db985c89dbf2a7d5383c4b730ed5f22cbe2eb6

SHA512
e403ef46ff4ab4354b13f9b962534ff0d46c9bff22ee33ab184bbb4359f0ef74d4acc57aa77cd88261a05ec2822c9419c97b2594f5d211f7c7546737c873c766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_rapidgator.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_rapidgator.net_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
25e811b8a701a99c6c916669028ac427

SHA1
9e4d7f286acb8ec475450d06b097f601486e069e

SHA256
8848d95442d6bccdb3ce6335a1d17cba718744b755fcf05e13004cd69a361004

SHA512
8800201b261279a7fbcfc2ca9ef714a93172ef766a0eca450fc3c3d597f8404ab170994f47855ed6984d0fd0925589012e9591c1ea4ea61951c04a07678d23db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_rapidgator.net_0.indexeddb.leveldb\LOG.old~RFe59b174.TMP

Filesize
349B

MD5
3cad2e9903d75fd974dc4e76943be384

SHA1
a5fd7ab74ddbb4011772e0e09ab85a4f4f147881

SHA256
475eb312623f7738b51870a28ac6f30c245a973fbf9e850d2122ca1fe91aee33

SHA512
63ad80887d171120ffd0bd07cafb77eaa7472d346cec3409f208c508b796caedccc3a528f4875dc607abd9038271b1ceff037ccd5bd6dfdcc52eab16bd30a37a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.mediafire.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9c6928962c862e0a6ed488adadd7c0b4

SHA1
c0b048337cb5129406178dbf54b2693463655068

SHA256
583485f71a43eeb27b32753101c63645756b525204bfeb32cae78f7dc5490d9d

SHA512
4a2755d8d6509c034b48f27ae12c8149939b9c003c7c00b0966e7932e4a8056b5a44aea46d1f54e39e7c607a66372e2c08b44438dc62d3adda80989791ab9866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
6a624b01ee31c69f62c48be5ee963de0

SHA1
f654217d19bc727cbed79c2d155ef7a26bd86936

SHA256
b84966b4828a88a61c3fc6e26a0b3017355ee3c208b066a70a4aeed93fac6b0f

SHA512
37f3f8633ad2b090625c7738a6f24147a94f0f8f030e19a6f90d5718d43e117e7227210abda90a28b77049526ba1fe8eea62490baaf4eccefacaa57e48e0898c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
607a85755d0f389e348e5cbbe26d7d38

SHA1
664e70b87cbed016d68a4e3c6bf704e471249be2

SHA256
4885246eb1f6474a02ec7e35f52a18b2986bf9b3dab070ada6145737e45d88d5

SHA512
550a7f921b3679558efcf28eb68ab68f571169c83a96130b8116085b08b1359282f4807da8d23dc1af1f4dfcade4267d794376acafe4a2c66d1752ac3c8052a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
e85cd2ad6e596fab49f7fcceac530578

SHA1
c8609d27b834032b2bdd3d4bc5a7063471f90aa6

SHA256
ff593d365b2d872bd51d50a33d23dded330541f27e8350e7069252b9326a93f2

SHA512
042a180ae83cb7cd3e4c9331041b53673cba9c5135550816f3195187cc8461955c600cff963c950377228d603ce04a5473626db10a556ba2d749a9a3e3b6d16e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b933301e8ae8ab7bdf23fe12a28d3de

SHA1
c5cc31877e834bbe429074b39f2b17ef2f39e974

SHA256
bb79d2e528d3d9a2092acd9ecc7ba5520b3929e01b4929b7597625b389687c69

SHA512
cf4d734cb0aeb8b612e488b5749b419e35d7f1401078e763d9e27a92972dc8860ac339d8f17aceabfb526b11da608ff81e95557df0565d501a72b491a31fccf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0f05fafc8313923949e863f470213735

SHA1
1e4f16cb177166e8848b8705321da6fdc9a1d946

SHA256
dbd19799c607ec636f4e23a4bc550d62549cb8feda9c4fa669bb5253f0741526

SHA512
b79788498da5fd0d1302c8fa93773f146349301c9f56fd2ad11ad3c2ba68323b4951c9fcea67e4d46fa546f04e3463b8218e7d2a9674c3e7741e80b8a2d4a431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d09f1a7206c8e62172ff711946d3ce30

SHA1
ee81d4a43bd10beaad41f82e3f77561d7914ba6a

SHA256
2f3d6a5899f94cf6541b8f44a04ce8c120976c75489e5f416830bef27de0feb6

SHA512
c947d26c05b97cc84db951abea6ffc8b313c94e68da61eb72340cb6e4340629734a860091ec07492930f059e206fdc27026c7bd3f1723d9f7a15d4bd24b34b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b484d5caf94790bf94c6176b2c8e5c71

SHA1
dfeb45f7f8b5494270b67d6ee1327ab44ea702d2

SHA256
ec2789bf59382398f620579f87fd6efbdfac87d79656d0a2426a42c6be243236

SHA512
fbfe6f938f25ffc9c4e9d0be52bb24a33c16fae83dc5c84c4071ab81ab7e49014b26d4c02a84c0acd5847844feedceeaea43682ddf459e4a49308535f8f0a337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e04e6229f6618169190920ea9b83d43

SHA1
7baec8a349f1a737d4e6818a3b0e85007372c783

SHA256
3cc01cfe2c54574a9ba30c0d569afd567087e406570d9733c4409518973f6287

SHA512
0a054365f1b40dc3f130f33c4af9dfaa5404e6ad22187a8cb87e09c3a0b2f59cc96c2cf9f3a51c34101da46a9a610236b49c57dec8f45840f9b1bf7cb4fa1bdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
76b4ca44d2aed36a8018522474c7ab4b

SHA1
913469b85fc33a4ddc280ac129c441a91f97fcf6

SHA256
dbebf2f8d1b473b11cd21d139cbf11c338f4491e0f3a97ae64c9dd15e1a725c6

SHA512
661db691f38be92b36778f154d2e5e01e1ea0a6daa43744b0486e4a24ddc6a5f0dcb65754eccbcba39fd35fa813526f489705dedd1942c8efc181bd4723d9852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f6a93b2fd0fe27bc90af12eeb4133743

SHA1
566d538523720a2b28909e33d4d9b6a0144efef0

SHA256
08390c63dbcb39a9abb2ec0c7e0855d5451ed65f7b490d979bb71fc2c2a0a44c

SHA512
4f77c9dd06086e36f768fbab4b465c2ffecc70f5efe9f0e0f60c531d2cbcab7e9f25c0a99b52e8b7b5324e97a6b32aaa525d3d920fab70a8dd47c6be77684917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d60e05107780527e8b7ba30a78540eff

SHA1
fb2d14649336af464959c16fa3e23fccbab43b72

SHA256
b9215fdd2d676a49952530deebc171503541ac0ce762b0ec53de37ec3f56917e

SHA512
4a54606b7adffbe891cdda3716d70b7afc57cac3f98701000b10e8b64563339ff4e0dd3a3e66446b5bbe2102faaf4e2f20e749ce70490166db8f94e291022c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2c93eafe7d2a6df6ed72d9f91a3e17e0

SHA1
1942012d7b5ff61852bc9f772c9e5bb2f41a9c33

SHA256
7c887442ce36523f937499790371fc09bce7ffca99f526e21cc7b6bb611bb79e

SHA512
317406a7438aa131ed72d28d5208ced54b8773c701f1d918ab6922e73be33fe7200587aacbc7da6865b94ac2a11efa3e1ee7edf66ea1fd2cbba2b1abcbaa0d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
73f09a3f5a18d5135c6134a0da07f82e

SHA1
5a9adfac43745399e5821d5c9301367d418ad35f

SHA256
e3abbc1d4b293dc6d1838eade955195a392edf3795ca2493a1688cfc431b5c04

SHA512
78a9e13df6304640f3c9683b92648888825c1b6b7da2ecb4e1f78554669660995299d68b20bf2ef256f89cb9cae3e6eed3bc09e2e44a95ad9c80b7b5fbf0e7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5957da.TMP

Filesize
48B

MD5
9ba1ef1be2198e42a9a9b08a06bb10ab

SHA1
c116e2098b197b3120ba5bca63ee98cffe0bd7bc

SHA256
f195bbdece86abd92bac423ba2481edba5ea5c281fa2651019c04fffb26965dc

SHA512
7929e7b939acb870b6c4aa972117422cc11342585e07327554e03ff9fe223e72b679fbeebcb23259ef1d4f49a28c74c3741b366ee15eef5acdca3b555afe8363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
514132258b39beece09a8df1aaf0cf7c

SHA1
4bfbbd654ebf95b8976f76840cb5029ec52b3be9

SHA256
1a8d871425418ddb578d282319a883e818e1593563d646bb99c566afaaea29d4

SHA512
46d7b353cf101952f56eb0163da200e32a0ed14dc4053852683484b525be3609f38bb7cfbb9fc9f013912a750d582e21306edc2f3137c4dedd8ea72b74702208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b8e4d864b0f8e64d524655d5d08fd6f5

SHA1
8ad60907bea235cfb96037ee39155b6ee9693dc9

SHA256
38cdf4f632e75926e7287d098322b7208d52b55eb16a6f0ced57e249a0fc2918

SHA512
60260c0b274aee72fc4e70c51b897cf5fdfd98abe06160065052b3dbb5f975227cbdc8d6e9c833007954dc918448357aa69b603ce7f035067784fd3a1dad5760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f9d7d56f0e1d83f89b63c226178ec40c

SHA1
0f1279d5223a37f6e95739594ae02c29672ec309

SHA256
7b4c7fd43e231a6196cf6321e60d75f9edad6847b8e0803a1437ad4f769c5fa4

SHA512
75db40f2ac03f8cbc00631ffafb42d25ae4eb7df1dca54eab01bb65e190c292f5491c19db771ca93dbe9f29439d1da863fd9f6945686250bee2d1391554e5d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c19c8107bc9608e3655fdb28a2459513

SHA1
b822864ecf5ebf671e0a6ca9d1290436a5241a53

SHA256
364a70799a0be936ec1ff9fee49624b1d0e1e8dd38c171cea8cbc884b682ebcd

SHA512
cc13b0007c1cddf4048bb8293ccdb47e416f9700c74a9204fd90961e11aaa60c1dc44c0409e0f336b3db60f562312309d09e3e71ea3f357290f5e1f79b3b350b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ea38c5667a9389a6f42f515422f25455

SHA1
313824228fde3c9c0700cbc4bce64efac9895148

SHA256
24a65eb774912ce4bff93e8de43738f051d6da2a4ef2bc1c0ea2167618bcaf89

SHA512
8bbdb7d0e27ce83d81a4b7b6535b6b6466923cfbbab04daf445b5030b48b79b8a83d7b84bf33f3b48207c066d839d9da838a62b60411bef66081ca95d1cef8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
91dc384ba54d927af07a7b39443a891a

SHA1
09fef786d06591843dcb13d9e4f03fd66acc7f23

SHA256
95f55cde3335eb6fb7c90f75b7341c9f5c2c9b7e02788bd6f4a167f48632cc58

SHA512
06cfd129192d267bce6dc7b35343334905af3fb58030512b1fd8ff4ca158f3ed4cc21d5859a8e19d3472804bebd9352ddf4e02ac783d2d691be5a3f9276b7f5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58df5f.TMP

Filesize
204B

MD5
d79cb47300cebf4f6801fb1a9813cd93

SHA1
24809ccb1283bea7aa341c51777f886d42cd871f

SHA256
1a670b3c17d29f10a16059d82817966ff7e13502ab20c008d0ff9b939442bf47

SHA512
79331f5381aeebae54bf9dba60132b5c2ec8329d6f11a79292e7188328d7cb46b833e666b30020b27089b1861180f5e8cb75179252b8d65a794412acd7071734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
aafc817a52b0d8a6f12ade5358f85db9

SHA1
1ef2c880205d0571373bfbae4decea6a7434efd1

SHA256
b162e51c1bde9c577a6395948ff5dfe11dd33f3fdf48efbb449ebb7f04759e35

SHA512
42d788ddc41517a59679bd5a85a97667fc3caaf257cf222460d4793dd6e3953f1b177c983525fe1592826004fa4522263cc668f277462ef89e6075233e2a0ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
513fff5458134299b9a0eece9f32adc8

SHA1
838168055390937c96e868c3ea8bdd89de034b9a

SHA256
75c84805bf4d20f5d2434b3510ef12a1ed73197a57888d8df7c86ef89f34ee5c

SHA512
570620b73d681477f3b2d9f6c0bf1cd64e30899f00b10f45cd00525829353952872bdab8a2a11c9e85b6be275ad83a3c913f38c6fa5744c3645813b5028528fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1b3c2116521fc4bba783e691142b954f

SHA1
0f77eb46653a4770d09afdc7d14a34763a5aa50a

SHA256
3bd8b8bee5876d048599998d07d782a239ab983154561bc95e6de0a42cd0de3c

SHA512
3e7669bfa86e639408e6760f4dbbedd840aa2d5c97208f6996cbda95fb2e9b6fbddf56cbf698577b90776c97c5403ef633953c0f3bfa717ccbb1b06f347f2106

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
92c109582cf43d222de1d8da0c17e63e

SHA1
100e10463b94528ae3bf74d9523e9d9cf1760d7c

SHA256
92c74a15882ab9ecbd984745354109cd343c65933f9878e8b8063e1127a10934

SHA512
f8da643b8074e8d00679c4d9d9c87756f471f9576f360aa2e920639ea4c893a4ddd0b5d7a35b565dc3f38a9aa31a7fd9b01557ca059bbf360ac53d58d2a66291

Download Submit