hxxps://cteamcaci[.]goarmy[.]com/Citrix/CteamCaci

Resubmissions

20/02/2024, 15:34

240220-sz4vasaf7v 1

20/02/2024, 15:29

240220-sw5x7aae9z 1

Analysis

max time kernel
273s
max time network
282s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
20/02/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cteamcaci.goarmy.com/Citrix/CteamCaci

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133529165980061082"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-176679640-153325197-3537295364-1000\{38CE8EA6-7315-4C6D-843A-290DD7295EEB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
3136	msedge.exe
3136	msedge.exe
3372	msedge.exe
3372	msedge.exe
1844	msedge.exe
1844	msedge.exe
2344	identity_helper.exe
2344	identity_helper.exe
988	msedge.exe
988	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1892	2192	chrome.exe	76
PID 2192 wrote to memory of 1892	2192	chrome.exe	76
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3560	2192	chrome.exe	82
PID 2192 wrote to memory of 3148	2192	chrome.exe	83
PID 2192 wrote to memory of 3148	2192	chrome.exe	83
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84
PID 2192 wrote to memory of 4476	2192	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cteamcaci.goarmy.com/Citrix/CteamCaci
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff86b599758,0x7ff86b599768,0x7ff86b599778
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4396 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4928 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3804 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4956 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3808 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4908 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4860 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4716 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1664 --field-trial-handle=1820,i,5908915830677356365,16807736439049641907,131072 /prefetch:1
  2⤵
  PID:228

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff85f5b3cb8,0x7ff85f5b3cc8,0x7ff85f5b3cd8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6625788181036863431,3867907648828108412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2960b279676187d6ac1755cc118fa6e7

SHA1
2896fc192d8f52b15b0d4e4f18df0b977bf7b99b

SHA256
a5cadc0cc589866da3b1651b72dd1d851a4623fe1dc44828f4a50523a19b9f52

SHA512
4ccc7fb9a31a68297967e4917a96a9b94ac3ff3690c64fdf7eee27c507161207a278487e301f9321cb3ab2565d21e319a90d7b5e5e8dbdf01bfaeaf18a4210f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5187c78807b20659e70c2608ca2de6ad

SHA1
cbd682cb83f66bef0b87581f154c4ba6536d6bae

SHA256
5a0387ba3ca991f0a8fb909c35ea818c880120daf5f255875ef06bf09205c333

SHA512
e56796a180101a035b36592fcd93d1504487fc98dc267d6ba8e4f5c32f4f62c31aebb8ceac8216dd472e691a8b4b08973080aea86259b33dda6fe318a0c33a5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7b770db523a7983ee68c0a05276bb63a

SHA1
fb17a5f1fba6abb20f2c27dbbc021fe166ed5c9f

SHA256
f36d08642d2e40381908af6bbb2bff8b62706470d06a97fbeb92dd8f89a719aa

SHA512
64579e365d4e8a2241931ba9ac2eaa1bfa686ea7ce92d44fe68d8f30ae45ab825d50b93f421f77137b6732f2cb1c567fac814ad8e14af2ec2d2d1297a00cdbb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
8ca6fc628d97242717a753818ef96413

SHA1
800cb2d6329c79aa699246b309c6188c35c5289d

SHA256
7b58a4cd31888a1148d49c241bbc14c713ad8dd1f9a57a0cce50646c05aa1c58

SHA512
01984705b20b3045226c79ee1c70a2d0445e80db6ff7b441d167c04d6ab6bab69f200da23f4da3f1797ba2d5653031ae5cf9a1b0120153532be423bbc08da615

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
6ec1056b50ae636c8f9df161052773bd

SHA1
c9b65105cbf7b10251910e9e431b5e1a77bf348e

SHA256
1cd1479272bb8443f9fd6c3282dfc70462b82b78e6fb0502e07b33ef184f1e5c

SHA512
b8706ccf76a773521c74f089b2452289181ec7bcad0b7af648f7ab2871fd787006777a499de245b8c298d6cdeafba1f810a308e024231630323d014801f205c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c8f7c2e7-5986-49b6-a027-3853b94a0043.tmp

Filesize
255KB

MD5
acc1767fb7d123bf353609cf763603ac

SHA1
e26af195642fa2455fe51266f3a16205aa6f2443

SHA256
7df99e5e2290ee7d2af36f842a48f3d8a94ecd2e725abd86d70da2850a71f1d2

SHA512
4d6cef474cb9e629b739d3ddaccb62cd44c77c304f2f2d42aa6d9c3ff20c5623b0baa34339f849db69711942b908a525807be71a59633aa0ad65a2986f70f634

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a17cdb1d2f99f0e60f6799abdba3997a

SHA1
751e5502111c4060357d4b0b57b9d7eb547960a1

SHA256
6db0baff3080611c62322ccbbb900cfa200dcf53d81455d411724f21746def25

SHA512
66e12a82d4715e7fcbf9256fcd3b8782713f2d5447c849815e4f123e9a1fd2571d6a2d3fd7ceef0e3b0e06ae9d21ec2f7168de4d7866bfb76db45d8f555da940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
29KB

MD5
df217f862f4073ce4585999df73a53fd

SHA1
8f39eb965e90eee20c2e94f547acf0db9aec24ae

SHA256
dfc2a82c870fd4c1a5b67929c316aebf1bfe0e8fdb90d64158a111feeae9c0e3

SHA512
f52da493abb8eeae24642e958cfa6ecf50101cdb0038ca7b952a19f0df0531e44828e4d2b9e365fd08a73a3f78009fd76af37a1ae58b8ec526720356c2767738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
eeb2da3dfe4dbfa17c25b4eb9319f982

SHA1
30a738a3f477b3655645873a98838424fabc8e21

SHA256
fbfee0384218b2d1ec02a67a3406c0f02194d5ce42471945fbaed8d03eaf13f3

SHA512
d014c72b432231b5253947d78b280c50eac93ab89a616db2e25ead807cab79d4cb88ffe49a2337efb9624f98e0d63b4834ab96f0d940654fc000868a845084fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dc05f5fff2b824e9f0ff25b540c37a1b

SHA1
12ddd14224347de03801b8db75f30d8e97f1639d

SHA256
a33e939e94028e304b5a9279e672c9afe5b6554b612096479379ea0d9d798e1b

SHA512
e80bdb8a696208ba01c87c833dd6f2a54eeb6a822045d4bcc2fc80d3573f4548291582944092888880977941f49e2fbf8a6d587656990d6cd2530e3cd8fa2087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3105a556f174c344cc40ed23c46a4fc3

SHA1
acaa21bc619bd1df16385f71cc4826056792b602

SHA256
21236540b6570c32341e0dc28a24e19e950f2f9bf10b6dbf40197969de4d9b50

SHA512
e9bf34c95d081091597c73523ca9d17f386ed8508052f3fec961236069b4359717b2bddf59ba65c69096d7c01d164e452fedd701060ff528246acb02ef5e0708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2eb4f7ed08069587b0fdeb6b57ce3b8f

SHA1
ce82ccd16987fc6d8a01fd1639316c4529a22434

SHA256
1032d0f93d31cdb3849734c51e32d5638ae58b1a638290a3969c71e6041d5026

SHA512
41b8cdb4ea5e21281664b25ed0ee016403c256f1fee3f20b61b3c4116673cbb8227b0f423b0b2665687ce3de6af34803639100ef845dcaa49aaaa136f1a21f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
00770f313f985d45c8b25b9459a6c872

SHA1
6e97c50caa25215a0ae590edd891d5664bf31af6

SHA256
b116020989f2c03d42ebb3a1763843e54ee70c7cefbf29b3c0496515c1216eb3

SHA512
ff294c4bbe9cac9bfab7a4855b054a22e770a14a8ec7caa26fb3fb8dcaa152e5071bbbf7dbf343a6cd99bbe572c52d191f06bd7431d75c44abb882aeac56ee7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
12c77444d13277941aaa69488cd5638e

SHA1
6d9d6b0f2debce77073231bf784d3a5317cd4543

SHA256
5427f221e02e19c5aed429d526b57e322c22239a0ef61eac8630f865f0a1d377

SHA512
bb74ec9abd3d9ca5351a6a69df7bef7e83d7a2db3c82dcad8dce14d32f9e51e56bf5ba77bde0808baa4651199732a2f5028a0eecdcd21f8ea99c5dbc4fc2c26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
f38841b4c50481a880ccb76aed83a7c2

SHA1
a34ab177178afe83723f7be03a8b8d416bcaa86c

SHA256
8cc593ba57efc6be919d1c272210683690ff9391aa071e71d0bbf83aea90cd92

SHA512
67ec0b270efdd639e13cf52adca55db0395adba514bd1f8ff93c5885129075bca7ea6fafede693bf857fec14e1de79e2f0adec76a8029e0af9b7fb58c71e94d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
0ade845651cd56bfb336cb53a7c2b9ce

SHA1
eb6e792e39ed5daf1e376d7885aa2925cffb3c2e

SHA256
ceca9f395608e5a1eda52055fc3d08a3bdcf58e8e0a2e1908e7c7c2424ac3d6f

SHA512
2c01456b6eb84d1b98d489f07d3a26f0d6cf5504195c330521174c3ec31fc62f61b4f1376e73903a8e7948ab7d09ad1252980b83f4f1eda5e6346439d0611c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98503e1c4356a786a02a869aa7f5254d

SHA1
0d34293fbfdca044859b0763f455b5a9059025e4

SHA256
9dc9fcca4ffc88b44e9c63327e15ba8e1b35d6cb82d2251e0d33719473821772

SHA512
b2808cd65eb647cbaa28e53b8edded6d49b5dcb60b37e9067da139e1346ebab17eea5629bc22fad499aaf40f1f289f6016410c3efd46a39738a5c89e6a371ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f5356aa96cfb55a9aec77e1b2bedeeb

SHA1
14e95f260f6a9a3c2b5b4e8cc68c769dee22b824

SHA256
38dfabdce7b89d0a4c483d40c27ab2b37f4b0244c814a8b9cd62b6ba7cea38b2

SHA512
9162757263a3c4ad0226cda9157003cb4471f5fe5a0332aa1f0dd12d124188ca67ee5671a67de1e41f7900cf32ad22e6c621f95c0924b7193b452c3b2990337e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e17833c1fea37d09cb137b0a64134453

SHA1
5093f70516ca892c570de290995002f9752da730

SHA256
6c9cf1ae0ec02c4e9042c8f1e359be1c01915b000bb0cad6acbbb986df1448c2

SHA512
f952677270bf1807e5d9e2c4539f9f6d4ca0142478a8d8a4d8f452b77f161dcad8ca939212b3ffc952dddfd7702cb191e71cd51907bede169cbb33f1af1970f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc4a0e529bbb39c88ae9356f51ca68d3

SHA1
8e6e15e5c824e36878e32b161d787030e9ec083e

SHA256
b8b826ac11c7cc42540c51234b6f2e31e7291fed7c1b934363a6675a54254bf1

SHA512
d802e34d0406b84a5050236ea006b79eefcdaad8a5fb40fa18b4ad845f977ac77dd47befa1286c6e6b12600a4519b622b1b99f711d8e12d91cce426103a2546e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d9c1c5292fbfb31fca1d63891d0fff9

SHA1
4db20e67d5f2aabb0e91b9aa48df31e497dfa0d4

SHA256
d4a6ad97751281fbe6eb0a35beb91e7c338fc4ac04464b1182192e704c63420c

SHA512
7b57242c99cbc51803a141c13029b24328c5ae1c9ca0d02cf1ffe8e70a279a836abfa4403240bc790d6b90679d593337b8d4b19aa6656f2bf10841aa24b07747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
731a40917553895b92a20ea9824f39a5

SHA1
5d1bfce5808405c090d129775c5852248cf8d6ae

SHA256
12b3d58d266d931c595d4f486e51a04b4c6f660ee4beec3622bc331652bb2505

SHA512
494f7d6a34377e1bcbc617d658deecf1da006a7582a84aed40e304db795702f79fb5c45dc1ea21679a646382e3370ec8f3c029a32597a2b3b73f29bb5ddfda79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84c1759f48a9caa8e6013cebf60d314f

SHA1
5d8c250a992c68be5121db3a155abd74909d4dde

SHA256
9baf3c9e2fe49ee6e5d89ad99dba837343231d652ff959587886181bca32f9a9

SHA512
a5bc787d681aeff9a57a7d220feeb3f29c6b5ecf55a1fa42a0c6d99ec7c6ad9af481224714f682232000891dd9bf1ade112a5136001a382c2264e10ff99fc8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44edc4401882aacf1ba95e17978a9ceb

SHA1
85c5de1c7ca0cb551518fc569ca5b971f16d2a91

SHA256
94581d225f21d9e28b3ed71bce1c3210c72ad2a66e417a247e11a71f059e3bb7

SHA512
cbfc07a1413f77466d47ed2f13cabc9153ebf09fe3bcb91ccc850da6a8085a6a4e4c505d0ac1eb412fca0cd47ee1bec1d4008f1a9479fec36ab299e39cd80170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d490aafc3a672dedb7471ed2194c45d6

SHA1
956a9e19830ee9585cc1477f7cf2f3dfc2d87ff4

SHA256
c4af40dbf3f596ad49be843d4756e2a962fc8c9cd14ffa2281883924508dc82e

SHA512
364b779a8348b2f587b8aae280d2ed5c599acdd1a81be715b0fe287d1e91ed9dece0b3e58fe5eb9fcdf1b77bf4581ff8c1600f2799165f449e831b2a7784b51b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee6e343e0d172245b951932ea3efa206

SHA1
1af476abe6f55d6a7124d3da77c58e9d50a7675c

SHA256
89d1828efe8c70bd60e2fed359108cbafc721d122341d5c49022d82cd0657c66

SHA512
54ad7232b2c94da86e9e8d983f2961dcb9cd386b9cd964d1c02e7fcd047d71df1314b0e582e14db6fe31466c25975707704b6063fa4598e8e2faf1eb9fc0d979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
610c8dad800012d2adab618d9fb91766

SHA1
ddbf829b68599e1c2b28aca0ae01ffea2f19715f

SHA256
b6474c5cfaf600fecb86416980be66fbe37afecce2504789a2fa0ae6daadea0a

SHA512
1173d8784b53885c2b7e17a38cdfd0ed05a5f97beb9c13ec768c74715e733f011f50e108a7123a667cdbda487418863c2be24f2dc2caa104651da0db37074e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
0aa7719c51a75c877264142bc5e245c6

SHA1
db7f7f0974865da3dd4e8c07537de96be8afe5b7

SHA256
dd0f717451001ea395fa9134d41627606d752f8d16d6542c465fc9ed23937400

SHA512
9576380c3c6c641ae9c2c9f0a08e6427a8d5ade4245b24cc6962cc83a6ac136476df62d3c69a02866b0f02638cf1a4ee6ababa7e7b43a46efcff38676ffd4c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
638972c60a27ce9e0a2e483b8c7327e5

SHA1
3f74a6ac7b521622fc24edf0d62ee50b7217eb21

SHA256
6c84689939a036ad8d20d738c2123aa4f198dfca4ee2ac642a595594769a071a

SHA512
d603a4db3f341d3d21b7b2d96f55d44d20d87cfb148ad98793131bd3a87909d0b27bbc7a214fe09afde084abfcf3346066df0566175d80411ef1c338757c431d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5931f3.TMP

Filesize
370B

MD5
d6028bdb199e61c691cd65ffbb34385e

SHA1
46b656180e84bccafdc22536b4552301f916298a

SHA256
61934d8f3568e8ece1ad18ba2104e67c682bfe11b9ca80ec57ce4c11cae3e666

SHA512
cf66e3f49fd56e74c6b1ac0fd3bc3eb5ab3e4f607fa54a3babbd7c640599be0fe4ec782ab100b71a5d76a5d934361a979ae8ac80b5f471eff4b99be863b95f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d320dfaf-3762-4ad3-8412-25817c2170e1.tmp

Filesize
5KB

MD5
caa12035010f59145491c99f0264f157

SHA1
08348fae10cc1b7b2c7a158f56f4fecb7d244cb7

SHA256
e55aa721ce77d070c812f57f8b4c3444598174d3db1f3f3de98d2af60bf854cf

SHA512
2e8382822155d42250b33ca940d2fd3ab699d00159a19ca35ed3322e81faee27a9799d6c76511d9e6f378fcefa6632fee1a112bd7d8d01a4ff2d996ab30649b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
022a1ffbcb8c69595cf7e6f6532d931e

SHA1
346843e94189e9d289735dfc192cf6c0aa5b60b0

SHA256
470cd8e78d5c336de78971ce1e214f531f439aed35f01d87bb34c7021300f062

SHA512
04ff7b6ac91278aa4bdc1963a445f0a12c500119109f7dce496a8b287d548d9a4ff23067b8fd83fa38c2041f6be958e35ee902c13a8135a2686887dc3331ea9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
379b9f10a146d3405aea478d62b90976

SHA1
6868a24825a9e47f5af2c9335bb41b5594cd1e2d

SHA256
287a60b117882249c624add8163989b26952adc716433007ed4b0e30f4786c05

SHA512
d0b4c3036e6452fa70290b264ff63b6ec74c879ec38bf1274c3b1d52b8fc8231f3f2e57c012509d93458dfe087fcd9872265075ab57d564db54af19ad965c8ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a4aa8016fa75363a99105b7b936d7a40

SHA1
f091340c8d0e23888adfc2214171c2dc56006c98

SHA256
bd3f5aa0e88724248ad83f12605d7acbfbbfe999a4f3a52f517f618201dab13d

SHA512
486190c9e78e491940f445371d82cacdb4c0a9f6de3437eb0718f5535562d699420f79cf2f2e7732b24d75dfe75035e167c12f12b942ab77662fee4cda58e282

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
17f585d1d972329c8a5733f3f6a14072

SHA1
1a313ccdd8356e07b733f03335f5bd2ef36f8374

SHA256
66f9d2df518ba91cab8cb5eb382505866ec8fa9a0b7e5ca1c117561e06eeb756

SHA512
7a7f4c7b9dd1e9a35da3ab026e6baca6d405ac903b4ea5820f67408809804817d36e25886f7c6a3da29826bcb2903c4bd3a550afc11a87894646b0cea884d81c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
8bfd98a3eb49844cc3c910407603decc

SHA1
dfb5d17a15a7c8e2b11f332fdf429011d1b39b77

SHA256
91daa51647c7b88af7257a11aeae0079609ee91ee85ab4c2706c8649ad707ba9

SHA512
6f3054e28d6bb5373578f52654958730bbf6023b8c3e7af16294b35f4448a1574337a0ff7766f0cf0d1dada8d325346f0a83992a7f3e542b666ef583ec283d01

Download Submit