hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrba1

Analysis

max time kernel
1800s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{4E1B7DE8-7A1A-438B-B2E4-539F6B4F1D1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3100	msedge.exe
3100	msedge.exe
4500	msedge.exe
4500	msedge.exe
3240	identity_helper.exe
3240	identity_helper.exe
1936	msedge.exe
1936	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

Processes:

msedge.exe

pid	process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4428 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4428 AUDIODG.EXE

description	pid	process
Token: 33	4428	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4428	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4500 wrote to memory of 1072	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 1072	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4044	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 3100	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 3100	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe
PID 4500 wrote to memory of 4684	4500	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fc0346f8,0x7ff8fc034708,0x7ff8fc034718
2⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
2⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
2⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
2⤵
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
2⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
2⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3544 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5780 /prefetch:8
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
2⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
2⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
2⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
2⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
2⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
2⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
2⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
2⤵
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
2⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
2⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
2⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
2⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
2⤵
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
2⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
2⤵
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
2⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
2⤵
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
2⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12032638766836332043,10749794978860158227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5936 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e
Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f
Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c8
Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000f4
Filesize
1024KB

MD5
089c0e843de55d450f24071645e1864d

SHA1
b75ef14b4042092122044b6caec14bebcb335ee3

SHA256
668534ae7f045e649c8710a42bb690312b016d296e3ca108de33ce9619116dac

SHA512
47e9b63c81b06d24aec6182f2fe28325f6bcbb0b11fb9dbf81cbd19b9d4f803bec97f6bf6c7f23ec9fc3b8d0321adf0dd9ba9c1901be54c5f036203cce3af8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000126
Filesize
16KB

MD5
5f5f63aa463c2955a554988b6bf7c629

SHA1
bd59d99fe45d8cad9509826c57e38fcc815fd458

SHA256
ad2db311651cdb318b580ccb11093c4d781a7695cd901dd2e8ca3958faa1bcb6

SHA512
5d5606f5546600d0ebc91ccb6b8860f6e2c0c76453d76900b680c12b954edf73e2181afb0f2f2bf39edba1d323b52a5b0330c1b0fbe135a8714acff6244d700f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
8c10effb9da03bc66e3b062a4ad7ac99

SHA1
dc2345f18bfa565caca9100d1030af4ef2ebbf2e

SHA256
da893c96e2a1d4b9acb3107a00c35cce8d3eff24d4d479023273637b8d8a2f5f

SHA512
9a95f066bb3eef1ffb749f1d078c9ad93c2db6b59320dc118fe34fba18edb8943c109afd55cf22281586bb2019749dc39000eb2f30eae4d33d99861746723d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\001\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
6KB

MD5
bb55dbbef4a5d8c21e706b7186c748cb

SHA1
ff3a6f98caa793a9cda05b58d48988954ae3c4ce

SHA256
10dc44eca1dcf63303ffb22e66b23d6cc539664b3604eaa1711e41c9ebb84f16

SHA512
5c68a423c13620245426252c3fc76ed919b6264b8eb59d4d3c96dee5978c5eae2a65ea90b965e97f1ffdfa718beadf53938f416514794fc3bd6df3f82c500183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
5KB

MD5
d2cf062c20a1704cb969932a1a83311b

SHA1
843d86835c6b7b67ee524f253c04b797f129afbe

SHA256
f7ed2f96f8082c753ce4aa203bd1a3dad11541eb4520c53c7b13b3e70094b8fa

SHA512
090dcd78e8e2df768665f82d8dc145958776c100cb3b8d94652ab0343b10bdb7aa25f8ab46b9129a98f8d7d2222bb839e4265851e5c0151a8d0cff9258271c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
6KB

MD5
fb354473a16893c4b94a53b4923b7342

SHA1
ec8ab5cf67e9cb49d7d1f2989cc102b9b185628d

SHA256
b26394708d1927319edcbc3d288a3d5270b157f64b8c77518aeccb6713486184

SHA512
e242226ba4ac1f637e6c5344b3ce8888b16e8bbc3256df55f0a730a3230df4a5b562e5b601af6a32a92c3bdf1e57ba45a4aebe8b1de099fb03177548e6f450c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
df32d058749ba08ffe72a1046f50db8f

SHA1
31a804defdb8bcbcc844340a5f9ac3c5481af8ca

SHA256
6916a7f5f6142567277c08d57d9ba75df00b4518c05493b96a1f483cd87427ee

SHA512
7a37cb3989810ece0f69c302f87fe6240b6d622f2d7dbabb78fef30487fbdf28ef7e1178223f5ac7e67eec0dcce10ffd9a4eface1474d7ff41e5d5a1577dee6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
f20ba2b4d80a01bbd541aa8d4b5f78d7

SHA1
e5875ba012c41fe27203489665dee35c0a0d6138

SHA256
211fcfdfb8e95852efea28b9379cbcccbb1190d6851fd6ea41f745de0122ddda

SHA512
2ddc0f8b479d7748865ce606b640600ecad9b7ec82553af32f39f394c5a059aaa7b4c934c76cffc6dbb224fe1a0a68f3614f966c9d29ee30f9f11052f1ed2908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
3aacf5416db5aa3bd20dba85485c1928

SHA1
ac9a185f894d0832729c847e778eca036bf4a5aa

SHA256
e0c3dc64d1498c445d8948f89815dcace830d4efa13f8261af91dcb1cb1e9e5a

SHA512
948e94c37256773c57c4c97debcd452b897aaa095bf93b1736544a42375243a6f95aa540deb72d71a7adb50be399a7abf34b8c2c5c758a460a064b682a86b00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
10e61982923845592a32bcbd65685609

SHA1
17d7069fb4a6a8d13f07207e574d557d5d490990

SHA256
5c233227d62ed36e3afa9a5cfef0009aa54323de1fecf40e89821a6036b13ff9

SHA512
0b8e9fec6e365c4c833e3fad6f0f9e9392f0bd3c5755197bd427349e23ef2d2c9906446026d935db70125de52d8fb33cc2422b4a4da60f10e0b9869e85ce3e9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
41e3c06f6b6e306ec180ac0ee339d63c

SHA1
7cd7248c4664582c957d4b9543583fac449dd30b

SHA256
116dfa00eb5124566419c9acba29a783502ff21a9bdcb0a2125ec0ef390825e7

SHA512
7124394aa764b07c1fc7bca96560e4bee8c4a32b65d7f2ee8788304e61b3b08dc4fea6242519c727242ec0ce9f63d2b6f1dba1244bad8b1ed951a179b192f620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
58d1d7b1efbce160da655849b8f6ae11

SHA1
b6c64ea62052fcb82824034c57be77b54aaa581c

SHA256
bd0bcab8a9e9f925065f0cd92d8102d42c3d846bf6932f69c3a0683fd19baa06

SHA512
986f85067b73ae5d2c0ab7449292f354544bc7fd7f1a507a021b62b3957a96f49c9372d22ca12778ca223d1739a7cb377c0a1ee2b76a77425be08625535e44b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
5420f1392f935ea05814a1897039cf0a

SHA1
0e7bc5d764931b167f84e7f841a12e2a6a201c6f

SHA256
92db32ee1764506171124d3160e0271cba6815f5f637f92885411caaf1a08486

SHA512
2a85a0051c5957e71d3b3c3ac44df3284eb4bf8fd209f23789c0e02ae05bfb8f747e35b6f56d57433982df5b149ba901b4ffb3feb28b7cbeb9769e91ec8f02ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
88054b972da8fe7cd65ed737834e076b

SHA1
ed08681f5e67004cf69002ba8f672495bd5c5127

SHA256
52f4c7f097e5a81d1330388311dde8b6237bc11ca1df6d7285ca14c47369ea87

SHA512
953be9b28dec7416fa0bb059b59d39886594ac7a3d488e17f4d16e3e0e7dc809412aef646ed6d500b3aff52993fc59a616d1e9dbd6949febfa34d68b7cd90150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
52befa33f336cb053ce286462e7cb075

SHA1
f6c33fb3e43583548ec3ecac69f76b05544169f0

SHA256
dd167cc01f7122323c4069856cf95bf756ad972e49d5c0b9cea4fd4efec756af

SHA512
0bd71c50cfe22ba22c9c11ccee83cc495040bf89c44c34ea039bb62a69e8948a890b47f0c03313b24bab6124fc09282ce6c015ac041a765ba27e1520bdc5a746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
894236701406bdf1eff42f9b6074cda8

SHA1
a8c7d736a1dd85b6a19f97c78972f67a5c27529b

SHA256
9f541df573278304a7865a527538e38490d8affafa0454f5013c7e8f2ea5c2af

SHA512
f0b8b1e600b2ffa56841caa798a15d02a49fb576feb7a20afde91620561272c7ede88131a249bb2c17c7a8e16891391b34e04d381aadd75ef9a971e25626bdd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
707B

MD5
fce361ba42abad000d7668c264e5a4aa

SHA1
790d8401af00633581a8be75ef0e4f3878f5297b

SHA256
ad1f471b730a01425dab03daf93178ddf1f560120349e553272dbe4232d820d5

SHA512
1bcfa4f9dd034d6fece32fed1dfaca4047daed6b1166e26ebc9f0a741ebf56a46db0fbdf1ac22c62a9ea18d8acc7c5406682043a6a047ab3a971718d643c0a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
a737bdebac7e56bb56b2cd571a8f050c

SHA1
035282a6482030f9c8cf57a69afd7a1f8469640f

SHA256
2be208ba437c8246b77717a6a92a1d8229051f0fd2cb886e94b1309cf32e9b49

SHA512
33ea30eed10ec49fa81750009aad74dd188cd74fb528e209f21bb273180097989fe751ad2bd68dae7909d3e585eb75fdd44abb78a952c8d4f95907255bd0f3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
62eeb14f56e1da4ce5e82310cdcba42c

SHA1
e93230b52a46cce86658c754bae90bfa8cc3fc68

SHA256
3c730417276078851e56cbbf886536924468899280fa1a4e9ec3545ada26339a

SHA512
26d0e8ea6893df603da0ace48bde7ff1d5cc99b841b69698c407ab5db02fca43f3451442b0fe2995d584e56e5978186682129cea55f3c888590670f5774515bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579f9b.TMP
Filesize
539B

MD5
0e8e4394b6c8dd9176bcf042a8acf662

SHA1
321c23fad2a5519c08b1200ecd90e1ae5094c757

SHA256
a7d177c1c33687ca74d4749cb711a86854aa99a224e46cf6b4dccb20511f7a88

SHA512
e0778b231d7ca522959d7dfb9b0968d442f5cf359b430ae2c381184f9d5c373f36ed1999301429cce791fbd4cb869c70fbbeacc9a5aa4bd13bc72bc47801b95e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
169551da19e0aefa2aa717bdf9e292aa

SHA1
997ff50158f1c0fcbba60ed78ec2e98c9aec56e9

SHA256
6cc4ed79309b3ee87bb527147a0b69024c0c185553f2594782ea2f34efd0ca58

SHA512
700cd748df2a4c641b20c2d2610a6d8061b3d31736ad2348c8e0b71024af52e8490ca96f0faa739d4d1d4dd60d34ff2c0f847e2a32bd5059a3b7a475dde513af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
10KB

MD5
ea8dd139b942a08ab4ce71f887289489

SHA1
2a242fa434efdc8d29bfcd03f4c21858b90d80be

SHA256
eb1be697ad9c2a67a1a72c6bae19cf86b8289ab80e252e09ac7c07defe86a08a

SHA512
2d6cf827b469ac3ec69056386431673d90ab1f8b62f54face2389ceae8858a0f3d79012d071529161e6e352e5f073ba9a32395a2cdfe0f6e359bdd78d12c4c05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
10KB

MD5
eba8139dc728cafc119fa9ec6e717af3

SHA1
33b990b15f2f24afc1189f1336e8a8fbbcddde2c

SHA256
aff22ee4c137b54561c418a93e4bfbb807134b26da89a4dd06f35af734242b0a

SHA512
438576c8c3e26331fe2a1f7a4e89eb7ebcd90cb4007c86ccc34579e3ac31ba49e8113c77429b5cbc03d99ba73881437d20ad010b1edaeca7f4270e88b44aa6dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
11KB

MD5
88e49ae0d2ed2629425a00eef547d14c

SHA1
75e5b728b1fae3418a91ccad2511e1355b476c8d

SHA256
a8d852da62d5851377c6906c16861985e0badd53b1ff370bbd8fb4f953c9f5d0

SHA512
f5277f9b336a51c282f4d3eedc57e2c0de92f1dab2a2dd1578bef94a8d04280600ee3b6656a2afa847afcc00d46a4e1f48735d4feddfc45ea5eee6b05105ea55

Download Submit
\??\pipe\LOCAL\crashpad_4500_AXJWOZINMGPEWLKT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit