377ac497bdeb20e13ea84ca1eab709946535b77d4231007a7646509386a4af33

Analysis

max time kernel
1713s
max time network
1721s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MBSetup.exe
Size

2.5MB
MD5

7ce024e6e2248ee891248469894d8a9c
SHA1

13db96c5e8d67b7f1141d22567741cd45d659c1a
SHA256

377ac497bdeb20e13ea84ca1eab709946535b77d4231007a7646509386a4af33
SHA512

ce5b6e7b7da5d3d00ad1df64006c24c291e24cb63e855855375e52e7a18ea7b3d283fababb79046a59533bcd80d8c18f604d9ace64af7e712f18020e5b351eff
SSDEEP

49152:YXrcUh6gxrxD0Xc3StQyfvE0Z3R0nxiIq2ddIAuSF:4rNRxrxA6KtQRq2SSF

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MBSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MBSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\mbamtestfile.dat	MBSetup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1392	MBSetup.exe
1392	MBSetup.exe
912	msedge.exe
912	msedge.exe
3176	msedge.exe
3176	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1456	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1456	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1392	MBSetup.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4668	3176	msedge.exe	95
PID 3176 wrote to memory of 4668	3176	msedge.exe	95
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 3264	3176	msedge.exe	96
PID 3176 wrote to memory of 912	3176	msedge.exe	97
PID 3176 wrote to memory of 912	3176	msedge.exe	97
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98
PID 3176 wrote to memory of 1044	3176	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\MBSetup.exe
"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"
1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb51c846f8,0x7ffb51c84708,0x7ffb51c84718
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6517145999072365944,14425828305761146174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
20KB

MD5
725a47144d09a60511f1e6e092c4f3ec

SHA1
1d33abca47326a1c38cac103c24037286c070caa

SHA256
3d50cd70dd62d7b1fc35c31e95190853426a2cece901bc184689fc4dfea9e55e

SHA512
496d0a786e4253a63b8531da2f601d08db361a16ada894469a303b5355076cddf93eecfabe02cf636400c0aaf354c9d6b0ee259dc8e04e052944fb7ae91cea53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c257f7b1ca1d4f97696d15dc7f2e7436

SHA1
8d1204fa44698d5c73c6e5b39b12c816cd8b2a50

SHA256
ab027455ec38dd8c63e8454dc64ab717f2cd512a3e674445b9dcf1250eab1d30

SHA512
9c18378d4fe939161bfe06cf951e4c1c337409be84729ce85f8b6f697bef1ebc88f4db96ce38df5a6ad8a78040b7bfd0c7ae5e3430c11617f565dbfd18ccacdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
70KB

MD5
031c2ca47faf8ae1fcb220fdfb1c2d41

SHA1
b66dccd9ccb8e8bdc6b3fbeaa32136c54264deac

SHA256
4f3808464c49eb1f2a59561508b2665cb8dba881f0b65cbb7e5a4f196e07a88a

SHA512
516276a5c6f6ecac3260801b0430e7dc039c333e9fd824e0ac5f0530d0a6ccd3dabddfb7f17f482a971b5878e3b443c4605ac3feeaa3c40c52e2e341d3704e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
88KB

MD5
a09b4113380f763b4022154f7c53e265

SHA1
b9e2db930b4083777e782135d9638b6ee52ff22f

SHA256
7d3f43773938ffec113162de22b476a4f10acd93110d6696bab68c71198e6713

SHA512
303044710782f0047a1ce0b21e667e01491886b55ef4a3cba29aa81e45ab84da10ac0187309cedb12ef5dcba03e0ccaa7ab50f71c93e25517b733c6ff1ef101f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
29KB

MD5
f85e85276ba5f87111add53684ec3fcb

SHA1
ecaf9aa3c5dd50eca0b83f1fb9effad801336441

SHA256
4b0beec41cb9785652a4a3172a4badbdaa200b5e0b17a7bcc81af25afd9b2432

SHA512
1915a2d4218ee2dbb73c490b1acac722a35f7864b7d488a791c96a16889cd86eee965174b59498295b3491a9783facce5660d719133e9c5fb3b96df47dde7a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
60KB

MD5
5d061b791a1d025de117a04d1a88f391

SHA1
22bf0eac711cb8a1748a6f68b30e0b9e50ea3d69

SHA256
4b285731dab9dd9e7e3b0c694653a6a74bccc16fe34c96d0516bf8960b5689bc

SHA512
1ff46597d3f01cd28aa8539f2bc2871746485de11f5d7995c90014e0b0ad647fb402a54f835db9a90f29c3446171a6870c24f44fb8bbb1f85b88e3ade9e0360e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
16KB

MD5
48c80c7c28b5b00a8b4ff94a22b72fe3

SHA1
d57303c2ad2fd5cedc5cb20f264a6965a7819cee

SHA256
6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356

SHA512
c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
a105061deb1e887fee7a1e6d543a2589

SHA1
fe043a1975efcf135a1ccad86e54b9705156a3bb

SHA256
eeb33969c8cd94f9e80e313784e37d3ce5aedd6c790d8e30f8e5255a9bc47296

SHA512
f5b76273169098f878033c30bb9bebdcb92763aa4b6bd479b62e6f4f553bf3d054dfdd1452c2f064145accc89bf9387a47e31a83348ee0dc34174bfa195aad25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
4b2afb85da183d644a02023011f0eb44

SHA1
eea31cfd9780553df9d62ce49c11499e0c28e1ac

SHA256
7985f32f0d06a3a1aec8ed1c4f484ff1c55cc02989a0d3e7996b6497c76a3d81

SHA512
be1d052ab94d5fb2f85c35032aa173abdcaa6956e7328bb93eeee2ce57477adbed8d21f4f62907ee127a682509d04398d4e3c4ed509353929c471f310ff3da8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9a2c5affed1ebd2214270ecc1f184bca

SHA1
76a6e2028384a42482a1131bb3a26ff3925b851e

SHA256
5371afc085e61e5247d7c74b96a9018107e629c7ee236ce871a29751b84c13b8

SHA512
7f6b5eb4f9e56294c7d5530e76f11e0fe6a0f488b4efedf94ac6ea525ab71eb34ab03baed4f9a5911950614ba59f50387777f59d9e38abb828a47ba529ecd2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
39710bd6999fee5d5e2dfa720423ef10

SHA1
b2d3a64133a59109570cc3e6636e95ff24dd21da

SHA256
4d7a6639524098717899d7dc2e10587c4a70589433e19508ad32a350de82fa43

SHA512
e339a73162151616f952bfca338bb0e9574061bf500a93832052bd7e6ce78c492855f2a09484e281916d1e21456a72b566ebd2ce0af5eb69ba67e1bc17d50ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
16c928f8033843205d8f090d37a8933b

SHA1
656a87be3efb72ce1bd234a7757ade71f86b2fe5

SHA256
3cc7fecbdcc76300c634ac102b561858bb1589f3a9b70c70bbf1e78b60837813

SHA512
309c429c4ae648188ca67db911dd6b4204297ae61ae1388019acdca0a547abc12a3f97d50335bf9699b7b5dbf285e7e61ac4ad29529683c34775a39d493e79d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7d649a12299826f06080bb3ea5968aaa

SHA1
2b991cbd9e25b56ff328ba0a80a0b3a4ec16659d

SHA256
20de6891600cbb1a72adddaa3d7c21341aecc05c6c38a93eae186c96dabcdaad

SHA512
ce46ee25fad4dfd9421e757fbd2c54a24a1a0e3f342f767c20122dae9418f74675464527288fcae8a9b48490c6cbb5804d740178a8b329e3c70379786c3e1063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a26fdd48f9f62528ac1945d3d564967

SHA1
617336cf6580d71744b391a0cf11cc299a912848

SHA256
788c410e0a7cf6bde23983a6bebd157576a6ee69e4907fd60a6bcdbe46dca36b

SHA512
45ee0358b54f39e06bb73fba70bf5e74c70f11966553cb0ab6226b6dc81aa237b163fad3bcf22539be601229f30075f139863ca2553f79c6ea43da32bc866e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f8b3a3c8a7ded5fe5e5c6e667ed76072

SHA1
b50281f54cee688b8b5076a07318a1d04555c6b3

SHA256
1d7acd7792b9375eb12ccde320ec491c21fbc3e0d36a636d47561b077918e50a

SHA512
72cc4822bac7ae5ee12a940ac4d8a91825c783ae6b523d4a0d0dd4c924cbd86e0aa2c2cecf2f56fe8798cb949cc5a76f753b10821e7442f6461c98a7d1940dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
30d14ee1578b8fb76d0f4aee83500148

SHA1
0dff734d02c1da09da27efcbcbc46e16f237d7da

SHA256
793b2232d5404ebb2f2c21a175bfbaa010c0bc2d9c9e746391b1358372e90644

SHA512
8386e641a176c4fdc48b5c15d29ef33f27fe4b1f5a99b4f9332fc8896db6a639cbc7ff5d6bde3878a0e8896d4b3454c464e19348ee13614c6943152ef6f2eecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
35cc0a6e43b6b1acad7cdee9d813029f

SHA1
a37058c4936ecf41a379980f2b1a21adf9082ed0

SHA256
8cfcd80a50ad85f07d9b6a884bf98907d0927849b02d50fde86d55befbe65598

SHA512
cf39085bced40b8bcb3b3f69215c6788a3163901e8e8409c33a769c8c5f4e311eb9e75d045fd92cc9cca9dce0dbbdc8535fb03a25d02fb2d5ec107cded677a36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4b1bff5bff8996c843f7ffd044ac172

SHA1
560494543ee4e6536c448583a10383b9dcc1d495

SHA256
f9c7ea97ec5213fbe440fe32f18aad4a7995fb19904b53b3375f19d07145370d

SHA512
f2a8114e5e106ecddd6d2a04bc982e0548ab554cd67735466e7e18f3c14ea83ebbd687dc269f1ae8507f965e51597a4b47fcb1ce283c9afcefd7233f1f78343b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
825efa7a9787edb57d535e2c3d3083b4

SHA1
c691fd895626320f791818ab17da3a149abbfc9d

SHA256
f6f6d025442b419d1a5384418d221c2054aaf1ce7200995b3299971a2c96506f

SHA512
9eb6393a9271b5db8c304bea606db30180d988144bc5c7c11c32e014b2198c1b3ccdece1e54375fca8cb18be04728e32f8b5d73ead4b10aed601e58cac5d1f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b0792738cd2139575277d84a9ce5b81

SHA1
ba2630b88dd649e4006fef85377bac8e531efb60

SHA256
c6311ffa9be0e05de3686312e81024ddb4f9824c1cc8de6e2ca1c8f85cce31ea

SHA512
f86f633f07dd5b1e153f406ac1c3b3d85941fc2befaa833c2a2d55f0e5be2f71e00f5ab67c736caf871e3d38814b4711700f9a9002ab2f4685182ce165efcc65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
43fc3f34670203db03953d6bd6cdc173

SHA1
075397b0ba22415fd3f0dfbde983eaf16d391aec

SHA256
6849c9af2a74a434456975614803c6a1c822375c2683d409eb97dcc8484e5e61

SHA512
3ea3f932e39f760199c57273f107727fee385da71afe69014c0885d7945ecc7e07f1d10fcd33873ed19edc4765cbba62e62bf6e6d47b37cee1e8c57933d8346d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
677cd47e0ac602451882bf1fc64f0421

SHA1
83f95b3bcc7171abd3fd33fc059b1e9ffd633b6d

SHA256
7e116a31633943dfb74e70d9579ed89a71e987fcff286c983bbe82753da1681c

SHA512
5349ff90ad623b5296875dc9d618252f8be4e65ed2f3a36b1feafdc3f13a83bc5c38076713d7b4be93c63ad90a9bd357175e18679d426789f477fa96d053bb9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b57168eb1464d8e98f38356a0700a01

SHA1
1957566e577f09bf2502542081faad9a3fe8ec74

SHA256
26dfe861f33001f28baff974f584faf8462b2873053b6978e2c7499ebc980014

SHA512
b4b15e7a9294628f07771d0dfebe3a0f659cbd0a1fa7a264b2584f3e2a5ee1d124d1d6b2d6a32f50738a38200de80192efd68690525d1154ce70cdd791d5d819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
305b2f2de00cc7d427f1cca1e557f254

SHA1
8566d0444d96a9234418a93f7b2b88b3174061f9

SHA256
4750b80586c9258df21951441901c71fa6ab2c3f1e6ba4443bedb564ac30e970

SHA512
b1239b0bbbcc41e8d7dfcfb480731fb3aeb96552c95b6bd70fc28d029b53cc783f23c886db0124402a019511a1697a56aeac75d27137da584fe6895c5617b4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0915910226764513e3c0808c55f12f97

SHA1
245051a0d763766df228f89954ba3c26d1030c53

SHA256
63c5aa2183b629c1e968b521b20cdc0603c524a09c88f24499df191eb7241aa9

SHA512
ed21e84dce632c5f3e8f6e97fa90bb4fe5560dba44efdf77ef434a3e1a808cc8162c2d79f207f4f1c770316b46a10589a8510b43bc00b2e46b2bfc18816511b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6cc838b44f934b5337f9cf1f9e5f6d48

SHA1
c7c8947879afc0a002514332aac814124640f352

SHA256
737b8504a0e225d417cd30137a8d3563ed3b6e8c968eb3fb70c7572e276a987d

SHA512
f901168a20520f83764e08dfeb31a081db5f9541623e68cb3b881167c8bb3ffecdf10ecc04af1cf31da7afe835be506d2efa80f2b671ce8b07151e3fedd6a1e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
4KB

MD5
37a2ca7bf4bee32da0b9fe7541904a23

SHA1
eaca13e790ab8a5ef29994ba88f815eea729e488

SHA256
22d3738b632026fad7f36d64258c4ab12521136d145de13283d7232da05faf35

SHA512
f013983bd0e8c7784702044c83099a36d55731581dee9b2011a6ce79fbe0fd01cb5a3c02757e0310207e1bfa7cdd67f8e9f739954fc658515319e1a3a168d80c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
2KB

MD5
25d6863ae51233ec9429d6fb091323c1

SHA1
21cf78e4142931c59873a8b46f77650b686d36c7

SHA256
eb305e9e398a3587e7aa4575c408195040c4d04dc754a3370a6e27573ef66d92

SHA512
18af92cb742fc24213831bec0a96441400b19b8662e3167bee4727ea698ad70438f8cca77cd4bb9dc9535993e288d9442b8fc0924ea8be1f5631777762656f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

Filesize
3KB

MD5
0a2360a627468b768b088f612866485a

SHA1
9bd14424a1506ab531947fd984a021eeeee5fbec

SHA256
669f63733e66f469254dd094be95440aeb5395a16caebedbf18c7a67324542bb

SHA512
ebbb48c980871717ecf0233a079e127d539b58bc37d6f1d0430b3616bf7aba53509177cd85c7cfd745b89422a2b85eee7c96c4f50698fdb4cce150b27e6de1bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
da140e99a521e90f034c0e7c9c7cbd59

SHA1
056e33cbb4725063c122e971c6e7adbe7b59235e

SHA256
162ffdf3df2aeb642b8e31dcfec0d792b809197d867dad5717ae38913444a137

SHA512
5aa4d814e138b5227e75353f71eb3aa991f2f6346b7bd93756bf425d524322676fb276c765cece042a2e96a238081181d0c3a400e4e791ba162dc1a39a46183f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5865aa.TMP

Filesize
48B

MD5
7402c89d398bbc4dc16ca9fef7d41f2d

SHA1
782e3ef726e9818cc570253138fd1fcfb434e457

SHA256
6d19aa80f51284860f8cd7752f6613f8fea0a9d63da76eb731c09cb0d60a81c5

SHA512
0eb8a9043085dbded4b9632402c415beccc542db88f2f1febb32b2f1b5957799ed78cfc90c6c0e8ed6da5451699c8157b6d35e976061830ede5a4aeff3eb24e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
51fd9bd5016474e579235c0434c38a2b

SHA1
a7572b19d166f43e2bd22e5e80ae0c7dfad30149

SHA256
06644a1e6a6afcfeae9531f4b9029f0afdfeb50f88f980c47ba75a788d5525f0

SHA512
d75cddb48d1957a86b804467292997ae20a0b1b1156d24d096c2515a3e4887d2cfeb61ba3b63bf4aaafb8392783c92c4b255611232a06b492fbc9c5c0656b43c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
7b15196208a3dd4707f8cac446233ca3

SHA1
4d77ecb8f81410c14441dcd63de379224b42393b

SHA256
bb46dca2a285c4d860d3bde76972c6cc1a5adef0b90720cd6b68b161493881d2

SHA512
5639ccd624f404d5573c780711e5c3de10a5173860d022924588943cc928b4367e8f78617cb511cf0709692fff7ff913b79c952a5e90b26bcdba00f828396992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
9022f680c1284b568353f2dac4f91789

SHA1
02ef6eaee2605a443cff2d5f70c614603070ff9f

SHA256
9e39343a55229c151614389558e70703e38692f0260ec8eeb36fe78edcb095aa

SHA512
6e5ed06f5b36a7b95d75bc1f9e5ffa55fe3835489bdf71443c714449e7bf1c8b624f76e7d16dedafe6d61eeb8156d2253568b3c7e407f3add757e7e6291c48cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
629d132dd0111b15dd59b2ed07767dfa

SHA1
5bab95b298f1a0f6925d3e8d7efa50ec44a992f1

SHA256
32d591d223f8bcf2cde697112311de71a10ffc9e05bd7896425d3e50043bbdd5

SHA512
e7290015f91ee710172e1f459194b97ee556a56da648b95499105a4a0db7c46a42e63bd9a5263e52ea5bb4fe067334107d687c3f7dbd06f3f165454222ed5110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
cab653c5e3f10651f5349a8ef3085c2d

SHA1
91cba0dc6a9d69b51159c485133d662da926b82e

SHA256
d0a9dada2c795594dba08a7972457c2bf7945c4df2bcc55e263cf415e0597b2c

SHA512
3f627906495c1f466da1abf166712e8c72aa9cfb8a6b2c3ef9e573f09b713f661dc15a2e063fd978bed06ca35fd234bba7c528535b7037cb807af48cf20fe42e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
9577a31e3411d78824e66751c01d83f1

SHA1
354d54a3d4cf90668277749ba753ee5df40abcb5

SHA256
45117a998767d2be65b6640bff4328b81b12a8c49b578675c800b17dff7dc407

SHA512
0f8b43aabca4fd2b1b0a3d9da403dcdc76ce51b48b77ea58c5819ea158384efccf6340004086e47a7c385312c2e679194c642df8798bdd8e83d55a6d9c6d1eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
525a7955d2fcb0c796cf6ba88a890b64

SHA1
f455f2452fc5500d399a4493cf87c5530877981a

SHA256
c8e41fb04f84160605eb5b27dbf62c31042cb906123a5bc28d0f35ac431f7043

SHA512
c2896862072f1d33cb09af06878d25d60f84d1f58eedd315e8785ae98ce3cf22f0d6aa715810a7853c0bbcb6401e1c4fb33edf6b5bda3e781746d310bc1f6453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
867B

MD5
f4d30af16aea660ac362591c8c14715c

SHA1
2282ee7fd77b60c598ca5a9d162734d0d34931c0

SHA256
42525666fdcf732f2085162e18ae20249b6bcef16fa98de639a056209fbe2a2c

SHA512
eb548ae015ad566216c28a44a358f2d647eb9301c293a44e341d4cf1289328f505c0418584abd1a4c18ecd91b04691d93909c868229c5a496f499fdc9ec31857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
3b2110c73d10933cf4b5cef5d8d32e90

SHA1
93faa7b3bc74eb7aadf92fb745cc6c183932a939

SHA256
fd341f22b1e8150e5cfbe6b8d58d0214299a311790bc4a5a0ede996c77a78a85

SHA512
728cb2a4fb3d941245bb9432fe0bb62062db8becdedbac5b6332b9d1c33e3c2bd726453329d888cee029ca0809cf705de53b149ecdfe929f5d704fd810122302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58658b.TMP

Filesize
871B

MD5
62d2bdd992566b2884cc4655015856d8

SHA1
6678e4dc5f794667948df8a2e1bab7226b954b63

SHA256
53672ed312478478a5eaa71a0d1bb1b5eca5b6c9c57925b360ae9d258a00fe45

SHA512
72f13f9c87f73ddeb60d89dd2bc040bebf1c81d23383ce76441c59a8f58ae506e89b5ca14bc4f0c053bcd68b3e48938e4475e71528e7d3984f627b9e97b14560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
06fef6c14ccbad987f376c62983b6839

SHA1
b59df244c3ee6088b37a12bfcafbadbe7e6c502a

SHA256
faada10b491725805fd30aeb68811f5d4d2922c69e48e6c1747bd41468d04019

SHA512
f74062811e7828b7cc0c4e33e18c1532ca6af1007a34cdadf743bfdc9a28b028828b487353eff0c29a4931fa337fa7d803297def74f83f7f67ee7eef2e5e80ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
115c29686b6984709d01904bbc75f20c

SHA1
21eddcb7f0b130d1e6a8aebbcd6666c67e3001de

SHA256
83f7f328115e7a22e315801dcff164e1f7c752f4d5f888584cbd9dcb6aac1622

SHA512
0b34473a0be258f680f27ef3a54ccff09bbc7cb8c668594e8b04f258c8465d0bf78377f0fa5c57e04e808b491cc39dffb6cf3281359352022970528e71b79102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29583ab2c22d3d779a6f5c84781b491b

SHA1
5a6790db124a3c41bd2eb9497ff275dfdf853e71

SHA256
b96596ef939aba2dd66b2a72104d09afb57f01ad162aef4666d70230fb510185

SHA512
c005ea47c6b945aa553d72e26be6b4b4bf509a5ab85eb692013f81db31fe0ee0ee29dfbdb2083c4e237662250af2da25b31f85587dedab7d856f35ae884a5f9f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit