hxxps://cdn[.]discordapp[.]com/attachments/1158366716196290620/1214885996500353074/240305-1qnqqabd84_pw_infected[.]zip?ex=65fabdc1&is=65e848c1&hm=5924702bd5182685a5ce8ab91a889ddc0e94ceed3ad3923cc945e571ed4f93b3&

Resubmissions

06/03/2024, 11:10

240306-m93gbsaf53 5

06/03/2024, 11:00

240306-m35m4sae94 1

06/03/2024, 10:56

240306-m1t4laae64 4

06/03/2024, 10:43

240306-msrnhaad52 5

Analysis

max time kernel
530s
max time network
572s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2024, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1158366716196290620/1214885996500353074/240305-1qnqqabd84_pw_infected.zip?ex=65fabdc1&is=65e848c1&hm=5924702bd5182685a5ce8ab91a889ddc0e94ceed3ad3923cc945e571ed4f93b3&

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "467"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "50"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "5"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).bottom = "842"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "850"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).x = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "3"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f809bd434424502f34db7803893943456e10000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-627134735-902745853-4257352768-1000\{B6B7F328-02D4-40ED-8F2B-55C169223704}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 010000000200000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).bottom = "600"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "242"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "1267"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2396	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
4220	msedge.exe
4220	msedge.exe
2304	msedge.exe
2304	msedge.exe
4876	msedge.exe
4876	msedge.exe
2168	identity_helper.exe
2168	identity_helper.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
1360	msedge.exe
1360	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
2436	msedge.exe
2436	msedge.exe
2304	msedge.exe
2304	msedge.exe
4352	identity_helper.exe
4352	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1192	OpenWith.exe
2396	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
3300	msedge.exe
3300	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	4640	7zG.exe
Token: 35	4640	7zG.exe
Token: SeSecurityPrivilege	4640	7zG.exe
Token: SeSecurityPrivilege	4640	7zG.exe
Token: SeDebugPrivilege	3112	Taskmgr.exe
Token: SeSystemProfilePrivilege	3112	Taskmgr.exe
Token: SeCreateGlobalPrivilege	3112	Taskmgr.exe
Token: 33	3112	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	3112	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4640	7zG.exe
4220	msedge.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe
3112	Taskmgr.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
3964	MiniSearchHost.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
2396	explorer.exe
1192	OpenWith.exe
2396	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 568	4220	msedge.exe	81
PID 4220 wrote to memory of 568	4220	msedge.exe	81
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3116	4220	msedge.exe	82
PID 4220 wrote to memory of 3968	4220	msedge.exe	83
PID 4220 wrote to memory of 3968	4220	msedge.exe	83
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84
PID 4220 wrote to memory of 3792	4220	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1158366716196290620/1214885996500353074/240305-1qnqqabd84_pw_infected.zip?ex=65fabdc1&is=65e848c1&hm=5924702bd5182685a5ce8ab91a889ddc0e94ceed3ad3923cc945e571ed4f93b3&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff868af3cb8,0x7ff868af3cc8,0x7ff868af3cd8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,14684867000865819821,766143900959319545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3960

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected\" -ad -an -ai#7zMap15275:120:7zEvent23270
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4640

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3964

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff868af3cb8,0x7ff868af3cc8,0x7ff868af3cd8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,12823749592468929272,6514901576800655148,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,12823749592468929272,6514901576800655148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,12823749592468929272,6514901576800655148,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12823749592468929272,6514901576800655148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12823749592468929272,6514901576800655148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1192
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" shell:::{4234d49b-0245-4df3-b780-3893943456e1}
  2⤵
  PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff868af3cb8,0x7ff868af3cc8,0x7ff868af3cd8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1412 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11543516192358772734,660674462636394136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4604cbec2768d84c36d8ab35dfed413

SHA1
a5b3db6d2a1fa5a8de9999966172239a9b1340c2

SHA256
4ea5e5f1ba02111bc2bc9320ae9a1ca7294d6b3afedc128717b4c6c9df70bde2

SHA512
c8004e23dc8a51948a2a582a8ce6ebe1d2546e4c1c60e40c6583f5de1e29c0df20650d5cb36e5d2db3fa6b29b958acc3afd307c66f48c168e68cbb6bcfc52855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a3b34279f8373c745cf85d502ee0670

SHA1
4bd02a6ac4d600c40e4b4dd9d36c7727f46891d5

SHA256
e024391a7649fe69dbe86272e2d3d1375aa876c9aee7e5b1c7cdda072c41c7be

SHA512
3280d612ce610e1dc6034ffeb6f7e8b32f7ffec8d8cb3f7489dd8c2ee8bfd63bb3932905d0d37918ce891ee744afdcac61492be0f49ce95e5397cf1d80bfe163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cfb7f468d2475f2e567d0d4f4f061ac0

SHA1
35e30421b9426fb34b9825ff64523dbf89f869c7

SHA256
f78617e168fb0cf91669a1f5d3bd81f27cde5a4dc32256d036983f27ae9dc3ef

SHA512
eea8372f5c2c9c2b5270879c9b51162e3bd4a97fc386a460b27105babef146a9a5904799873779e89c4c169461ad1cfb63d7dcf9b4caf243d6c67679bc2b936d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6717e0d50ea1851baf2d5a15edd1e6f3

SHA1
becd46359368dc76ec2955a699c37510a3c756c0

SHA256
033b14c414ae8d2573d28daf055a26397974868b597dba57ef21bca6eb4bd56c

SHA512
8b4c6b8d554f20d06a8892b0ee06cea48f3dd56e129d44ae2c2494512ebee77bb5952eeb256dcd2408b2bcebc2ced06f2bd6e837deab1ddc9f0498934e632018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
577e1c0c1d7ab0053d280fcc67377478

SHA1
60032085bb950466bba9185ba965e228ec8915e5

SHA256
1d2022a0870c1a97ae10e8df444b8ba182536ed838a749ad1e972c0ded85e158

SHA512
39d3fd2d96aee014068f3fda389a40e3173c6ce5b200724c433c48ddffe864edfc6207bb0612b8a811ce41746b7771b81bce1b9cb71a28f07a251a607ce51ef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12a14c97-412e-4820-8e23-8fe9d4d52922.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
4737400370d51fb6f57ae3feb0c258b8

SHA1
3763f7ff89664d6892a2b8316173f52fa15ddf4a

SHA256
3578fd4cb726d4ba8b231f35d35315e1fcfc7fb0aff492034190f541e35f32ea

SHA512
0bde266646ae67a35475d06382f328af9851a77d4120e10bd260cd4cd74682c751bd440f6f935ae750a3d6f8201a6761bb01eaf15ac7f703b6a9400a5b28fead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
67cae70d42a366eac462d0c9fa06078b

SHA1
a263261aa59960335a5bcaf4d19904bbf4c5ed6f

SHA256
74c6f6494410b78cad6587a56bdb10d14885b2bf3b150a89e99f26886291c4cb

SHA512
8666f033fd901ad0879c81d452c6e41d15e55be0bc67d86db250cc2618df3dade7329dc18302c172fd21bff4d10748d7019187d63e5dedd50ec2d0ed1f04f606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
065c39c702814eb784ae29e62a121e96

SHA1
ba4cf8bd461107b73bd10bfd57a14c6b42e6b49d

SHA256
1a5fe6b7412da870e27bd0da471946ce42e951c17d6852e397fea1e74daca0e2

SHA512
dd1f9c188011feded95780d5a7f3719965093ef989432c19c13d2ffd705fab346cf76af8359fd8a657001b85add7645fd8054e69c42af1a24b5542b52efa7e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
5dba3434aee33fcb9e56ea79e91b21e4

SHA1
4a3dbe7e9405ed9c0f0fcb8bdd158020a9e10863

SHA256
974c856f7eee7c6c7baa6edc06a6b1f2f25428f0f9ad7defd039336471417e49

SHA512
14ea905d7391b1ce8cc598385c5016ff88f8a95b7d1e8cb0a76d4129532d58d6940e70237f16276e4de76f320a611e56ad1ec990963ffea8c7a6eb24bfd4b317

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2600bf94f3eb8739f5bd08a069ff896d

SHA1
c00120e84f9d02246bcfe347052d19909750d05f

SHA256
23928b78a9248bb729c62bf4113cd917cb85e4e7c501cfaee49f86f01f37950b

SHA512
82778fbdd62c109688d764137d90b3d425da0f133873d72540cfae2252f53db11687da707b9acd1f48af122062bcac5364e29256ea463591d2d5dc5f710dbe4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
a141524d5c41039b25ad569e780938a9

SHA1
7e8b3a40ebd7ac3bc6399d779937afaf03f99251

SHA256
c396eaad08d4b8c35205156f5c7efe5be83b88fb290e6d41df48c5be190d70bd

SHA512
248d429d9ba6416553cdf505a6f5b323d82e22d6c847a8f1f1e109dca0b4c6e885c53eb9cfdd8bc2b48376c44bfd7f5020068f67899d377c030e6a5abcd6233f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies-journal

Filesize
12KB

MD5
f0b0086d4f61e68d4f418aebc9e6e7dd

SHA1
8ff2b3a0eb14c13c176a2f20769bf5aff8af7b2e

SHA256
bbb1ecc1dd1227661cef9c0deb44852e63228d551fa5d074db1504f12a685c04

SHA512
c96ad531fbe1332dbac016c340d91a3ef718a8b86841b6ad979fc65d8c9534128ac7ff4745f6129d2841a2d32bfd138733a65325a9828c50999e905cd5c5df1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
64fcd4a3f71d010787a81dcced847e73

SHA1
092834bbf11133416632330632e7ea4eeeb5f0db

SHA256
7bd73463288e3e9aeebba326683b9c0bf943b694d5449c517e41eaab73462ae0

SHA512
a599b666999bd729bf4f25b4c71adc7457bb99c49151ccda03695b8a011e1627685b693cc0b505a569ea6c6090401ae01a2dd205bd13433f7359f1d1514ec0f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
fd3a048a2320110b2721b5763a4829b9

SHA1
b781db78c27fad753b7723dbac55df6fd566280b

SHA256
5ce66b38cc596cc85bac60ba21705591ceec8246c7270e32410f6a564ff4940f

SHA512
c71feaa4002062ddc2852aa8aa8bb7226059e7067eaa5b8d4e32b7ba25007ce0195795303694aaabe913f24293d95de739d6424bc38c1c433cfe4b3f3c15811c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
7554dc34ce2a82d3987fa78b690227b0

SHA1
3e0ead9d195085b792dfe9efc956ba667e53fe6e

SHA256
a05c1c9b46e71ad43be1f81ee7e4a7fcb5057232223e7262e6c72218d5ff016a

SHA512
f811fe166f14322351664c838f18a3a1ce96427edb97c3e58b8d38aceb49fd1f74791bb1ec7f05d4d5a436b6541a47f0d9cba4fdb9dd394ebf723f6ac7566d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
71a7af52c8ee24131e9866f9fa060940

SHA1
1dd6c1642bd39c31c4f8e796d5542dede530fdbf

SHA256
47ca14ee5669e235a9e8fb065d73f6ee535d37dabd88a2e33b3dc7d1fab2a75e

SHA512
22332d19818cbdd9f3a6264e77b29a0f1a086fa9be80f73217275be0b1ae322dfb5f41fca2460f4efe7b0c72fda2091e9f9a4bde96b8d8d6169e0f5d8e06b852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4f3499d5b389c9de8cde44cd55cf079c

SHA1
015fbe513798ab38bf99c24a3a2b7bb3b0fa1416

SHA256
eba4a9aba094d83c7a0d1342a7f8645da3e96ab1a2d7f494b0428e5f53a69984

SHA512
98a1d284460daea897ffaeccc5400ffa2d118c88de020aa9caf9394a1dee82b6cdb88e53dac4f77a174ef546a8d1c7193af415f2a43d8018483b398d87778cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
025e49b0ad4978c43bf121782b561646

SHA1
fa3e285341b9e7f98a5f7e967eedfe1d76b787aa

SHA256
0ba6253693dcf0317395272ef2bd869fdc45889be958acd8c1ff850d26404ca9

SHA512
6a07f3175b27acb3eef258878f68581a64b11c8402465eedef3ab805a6fd890f51a533bf4b32ef005dc60c9a7fb0355c5e0949af36663ca304a54afb3006e4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0bb5ff035be2b8d83c7e89e372ea8f65

SHA1
43693b09ba1d2ed4e3ca4db23045b30ae8cbe916

SHA256
4adcaa742d25a8e0387e1938839145082fe2a5388a550fa6eb242ee89baef2aa

SHA512
c0ae052dab65d8dd141b438d20806d3e756eae4880be33fade1553f4fcbedda8750861fed2293c594224743e12a2a0fa701a7279f18c2141aeb54394fb9006cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f25001ce9a46918e63e4277e7a28933f

SHA1
815912b0a16c59c2c4de1d3aeb42f4f91c84f1fb

SHA256
b2d8419c40bca94f9a13ba01e84bd228f9d6ac19b3a8170070c4ea9338c5c7fb

SHA512
6a3301b4436a258c1ad36e9de04e8634ee84e9996834e00602c8c70080dc44f56c9589d48d4dc1be9e600f540b70103944be8ca234d30d48ff9b1ca284e1985f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fdeee7b214a3a191a63569400f9d4d16

SHA1
856df3c4ef308041f89ba307d2cdd5f4661efbfe

SHA256
0b688751a89c44a2758905702b6a131ab558f6b7804e0fc7cc3c5a7fab40b32f

SHA512
f7f7abf2a919479d18be6588833cb947e5f142b6692d115c42410e7e94fb0d76e4d639a94fef1a1e5e9c96aa374a29eb12a079b6a3ecc5aee3e198e7e691099d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2322b933ae8ff21367a21c3545ad5607

SHA1
9549ce729234029430bf4481e2323bb5c8d00cea

SHA256
7dcda4d336a3d32e2806082809a1e9ddd8b465b2db4f3df05bcf3ff522f3e345

SHA512
2fef6753bd14241500ec22dc8e6361eab69828c9a06a2c4e07871178922663c80cb3a5e4c98ec8988d6ea0ee6e4be61ac8b5808b74d4fbcfa2300fb729bf6231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad7ac8f4378c861835bc8b9a61caa0bf

SHA1
d0eb8747bbab3243174ed6d4f2a04cdd719f8d41

SHA256
d2e573bb30ee84f6bb3dcf8dafb13ad0be0415d344ff2d4e5e23543f3ba814d5

SHA512
7a33060d3daa16958ad3035190aad62dfdf00d8db8a736b9c15ac7e4a83131e516b0072fe9ea2a17253130d92951cb8f39b65855018754b6524fe3fb38299dc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c983401a4ae5284af44d13fa7821aea2

SHA1
52340b144586f8e725f2e29d5bb43023485af958

SHA256
a3f1411530c430f4482fb4ef8866372ff5b3f8771f7dc071405c5d3b6ba98332

SHA512
17bbee34e2ff3f68857d5ce386a0ecb2f1a0ea4303b36e5b79d1e383d1aa2ac6872757379d85d4b356fb18b0fce4b75825fb47f8f26c760a3e063d2bc96c206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e94ace1c97f341f774f84588dd936c2f

SHA1
50c89d8d2d1e8e9b03359d594e91d474afaa5760

SHA256
3d7616bc1a6aa0e93078adaf15bfa8a6cd381fe3af5472b05570e706d23b6441

SHA512
491a6b7f370ccd57f6218f7e99b69c7190e5578fffe5b750761714e39a116b66c5c87076c43233311a2a62e2523a7d770adc9e82df7b2cf2a2638eb360e3091f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
77a649e75136066a7e9716ba2f5d7783

SHA1
b5a9fc6b33451a4bc4fd590ee995fb9ea622e580

SHA256
3c591ddadd3243a988ddcb6d221457841e598bd59f16266fede7f3bd3310d4b6

SHA512
a2f9ef1a1122af3afa8c63c5a58e5292de4d09f5775429966b091d123630281dc7c050c89c6f1a5c75f4592cfaefb03a0e339b7e28c38527098478e19277c46d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a7739a7f1f75ad0d6b433d0100ac95c

SHA1
24e627c07f191310f7df11d31e233d204553aca4

SHA256
0225fd0e15fc654a52f9cd284d2e81414cea271c11f82cc9854aa07d50932093

SHA512
9005a83f073b21db8e9c513aa51f00a9f66410f8e7f80e5b4742a63ce1ee2b53fcb8216fbb54fe3b075437c7eb3896a6893283c7906e7759b43f297d94abdeab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c94ff6390490c1fa76c754ccc18877a

SHA1
a823a46882d7c8efbd4e6b17c99c704c56adfac1

SHA256
4978595fc5a7c55e25100e274b5eb2daf71a51301c4316f791a81023cc3dccae

SHA512
4b292328fd02c583475e636f7fbe0f14355b24f6386f3f8742024e6d4f2c961c81acb119c9bc9cdc3ab0b8c813833826e239e6f5da346dad9eafd396702c70f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
da30137f8a783ce57a31205bcb74ab81

SHA1
6237a4ec83f412177bd7481488cb6d49b83b2577

SHA256
e344bdfe8adeabb83b3ad501a4a734158d88483cadd2fe91ef2e6f6afb25ca8e

SHA512
55c7b748ebd6a4226e0897efb677f23424e1a98e00bfd8c8eebbafa57fca9a597903a8089f6c218c21bd9215f21892e119aaa1ada0b374437e4573d22e44718f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
803e7bfb37d460e5502a8dd10941c93a

SHA1
bf60a47166c4f8ef01d9e06e904d9715a08c1883

SHA256
213d351bf7321951a443977b69f0c7a1ed4b32db1051ce6286b62e9a2323b905

SHA512
7cea2542c66eaa26073f5f6c8e0e97beca564c0a78fb4c7c7c047b06a7dfbb1b9966b49d8310a8473815a927f92d31c45bdf91cb1683256a0a759554d9663efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13354196443852549

Filesize
488B

MD5
989217a12ef9abde860a48b51cde20e9

SHA1
c918e9d773b5da49e5ffa30816e11895984e97d3

SHA256
0822b5794f3665f800ff8b779a7e6e01b673d8656900ef69f740d620f28c43fa

SHA512
e3b6a6a0082d863e91577281020aee8dde0bc9210a2f751f453e20046959f9aa7cf89075b91f7010ddbccd05069291c0a2803308a6eac8de625b72ea6ae4149f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13354196444118549

Filesize
717B

MD5
cf6fe905c911dd356274ed80330e57eb

SHA1
174bc4854f05b41dc31ef0faf65276ffff059d49

SHA256
5093604768c6efcc3e03267a892b70e1ec3ca306fdc0aca8023741a3a1059118

SHA512
4e8de49b879a1bf6a49d45f619ba3a320184039b5eabf1b3ae25a7e47791786a9dd5dbf885625878c6fd69325f3e578fa79e778b86c20f23fd68aaf79bd6ede1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
a3c6827366458f92829f574bb6151f27

SHA1
076e1d4f2d5fef99a4be99a361373edca54acd4a

SHA256
71c98972968f1184a9496b0b1b08f55c416dde8e384fabdaad6e773a150ed656

SHA512
472f0ec53fffc54ec1d5d1f847b53c1c7105ccc5530b548a5ab12888c78bfe89cd38e963f2fc21f2e0c2d65586e290785564dba043b03ba47c94cde512d36768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
7f92200622503bc0b773cec5ed17ce60

SHA1
88e90e7d90b69b6ad6a0f9e00eb9274dfc90ada5

SHA256
4dcfb6730c83d1e1d426d91b933cb6bc2d0c9174172fea085139761e16806d40

SHA512
b6264ff512e26b659d4f34259a464bb487153f537a88ab324177e82e6072e2d8ae563bf3cd6a6cd127f64ab0023d1b87c69310224179eaba985df1a8384bc93c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
d3ac9ef173c8979b794b17409ba9edee

SHA1
46e13ad91462b007def6bae2acebbacf11349862

SHA256
18b004a24ba7a1d453171305f84f509769dc101ec52c903e79408443c82530ee

SHA512
362c3da6635cd6afae10182baf38775d7382220e66b737909ac93cd9e1cfbd16bccc6167e4998086b2207b91a2060f5d0ac044a6e7a334a10af93206468fa0aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
1c62da8b1ca56d9d070fd5c3edf7b75e

SHA1
b09e29d7737b18184efd53c0ca778e110dedea52

SHA256
ceacbbc41745948e2e00a2bec01a67343c5d25816f376bd9aae06e0d2cd5525c

SHA512
8ba6f291087243faf65f17cb9358aad379c9553f779694c1ec3561ce0ac0ab5ee1d65498236dc34b8a94fc01dfba35bdd070b4e8257c8f4befe7b60b11d33841

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd7ea3f65f9226e24218f7733bc907e4

SHA1
2d9bb93e5913ab6d8256c561cd794895e9450c6c

SHA256
d3aa077246901905e1c63089a57dd978fd513ff08c50cef65781e98e219f8c7e

SHA512
c9c153a8c321dc2270d86b5be3637818e1391831188b12710c81ec57b79cc80f5e00d91dc7c1b01fe77db7dc452ef00ff89a743890f5e5119ec63cc49a2c9f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41da64c7e78eb4ccd8b219c495c5598f

SHA1
77797b9570b1fbc910b1db8f78b528d3fffbf727

SHA256
c0f06ea82d603d0a6038fe806c892f30a9d4c424f737f327072ec510f12c2c40

SHA512
e141e03c0144c880f0084a7a6f4ffe7aeddfec5d653bcb89d8de90e88f7edfd5db603734d5a382d3d40d25bfc672fffbd5ec4ddeccecac6ccabff3fbd466ee51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3e71c2c7e4dd81d4ead848b5cc476b1

SHA1
2974d95504cafd70c0ef324fcb97effe7cf3aa65

SHA256
361fe2c411994440cd55362f7be40e8995e9182fc05226de87f2ee29d5304675

SHA512
f75fff8b0a4bbcde3504e83556c12211ba7cb1b1e26903bc068fb242ca542cdf225ada7a7e7e94c63d364b485912c2ef75531e826515989f075439129c85f6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e7906.TMP

Filesize
538B

MD5
641cbb6033614f569ee78b4cdbfc5f85

SHA1
118941864a56ada09570d5d7f3a7686c6a91e77a

SHA256
21c78fa919dc0d0bd5c781170db6c6c1fdf557a031d0d536f0eec980cf2b4530

SHA512
08801525d5a44ecc65cc155c34d3df066ada30f87c7472509b9709ce6001155b53152809cc04bda193ad5ff4fb5efcfd1b8657eb4dfaea18f2134452d279ec6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
c6698eafe51bb12f1ab8aa6cea75dc67

SHA1
6276b09370cb0c79fcf989d7f2e84a7e60c504a1

SHA256
780a070015cae2688822d018d64593b94b3bd38934be13078198d69eda58bf01

SHA512
f8de490521b3c4671a73c9b1dece7f7f42cc25d0b61cf5ab3f09548963aa0b4603f5c46b5e7e62f07d9420ba357aa77c3e6cc0912ae104f88c8c345dcdd6b074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
3KB

MD5
4055265a17607992b3d1e0e7733fd4e8

SHA1
b9c49b060af010db12b736b2fb8bf0d6f2e2ae83

SHA256
67849bf20dbefcd9b9d647abba4fc21cfa6e01d24c74bf299742416f761da01c

SHA512
54c6ad578a695b84329f70d657795b1f702164596780cdedc84ba32c2a264ece1e899dfde03137ecdefdcb9d2735cf18de2853e1bee3d0dd648d29983b1072ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
ba361c1feea5fbe57e3226266286f0a1

SHA1
386ab3b34de89f494133dc910a35209ec7a95dd1

SHA256
ff8617b81338cc53b38792bf4b379a7758b21aa4be742248260a5d0bf36cd8a0

SHA512
063fc8d849f814b9d96dc1dc97c93f64564b1171fb6a453532884ec0198b5d33e2c9b1ba3df9972326fc9b629618524f7e19188db03d52852db2ff861c8308af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
8a245173dcdb090a66014ac84dd22f84

SHA1
acac00ad8096bcdcfa73a67ee942efeaac196028

SHA256
fa387ee86a336afbc98127109e41c5b5418115ebcc4674e5006219da08dfe505

SHA512
edf7c9b74cbea5e721a24d74e283235bde7433ee76309acd6cf918ca55f6fbe37de8ed365a781b9d4c9c2baddf480ddc44f328a1265935775d136bb9b1b09fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
8a6cb6e0fb73b6a0f4cf7d5713d7e865

SHA1
1a3a28bdaaf8a34cf1f16d572a41105bf7fd8567

SHA256
c8ba5bd2b9feeb9962a18a5317523f3658e0ad4135f098095c4aa7d89473f0f7

SHA512
2ce2d300ffe36ebf7451b03573d1b7bf443f47fb9286ef3ef152ceda4d42f87cdf1c2a53ae99803795c3d6bdcc0b8d4cf998faecb81c6df74a5ed133a2f7043d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
6403ff5305862198add3e24de1f715f8

SHA1
ca81943029b8923149ab49e256bcc5ea68001cd0

SHA256
7cf6c804ccbc1bd130aac98860a910b4dbd9ce6241a1fe1573b8849b5e0b53d9

SHA512
24f3f25ab9afba9bd4004128645fd42f8401c5952da5da1df38277732431962771981adf95a719e6df1e1c78511bfcddfa288ecf617f47b10adf30ea280418e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
5a8ea4f2294bda097417027ee684d6e4

SHA1
5dec391406a53e8053f68b2f46f4881356534ad6

SHA256
ebae125767b140501ac2f2aaa3e7d72b574e2e42005fa8b3a009ef2d50bc6926

SHA512
e4493be4ccdd674d1ba921e84f9257329322e98edf518c5dbd19e79c943f0def1a64ba8dd13885548adf4bf8ea1cb95753c2f263bfa05b002eb9fd2525267c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5dcf4680c46a7e3b66d35a29a37cead4

SHA1
67f05a507dbb707632409f870be75d789bf43d39

SHA256
a7d716bd2d4f002a3fe9cac820f7ce8efe442fdd10d26b600f0820307da00381

SHA512
e0a40e1a358d604978d539d641f0feb937df68aca124fa124bf9e5c120c7ef32f053bf76ca4b74916a17be02e21d4a4ed0d78ff6eb75a09f79cb6615b6fcb5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95c75efa7a0866b25ebbeae4529cad74

SHA1
7bbda233fe57c54be4265cc3e204fef7108f9e9b

SHA256
0035c348eea54631489779710bc5181b251da51a0216eede96699f69ac98cdbd

SHA512
f4fa0c30b4a1b70e3ce9bebbc45ca8469796aad34fcaada786d9d246f262e9d8800e11bba82923f1fc00fca58e914b42cee730372bf76fe30a99e5e6a946218d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c0e745aa018a099fe16cf31895f54a96

SHA1
f9e9eeb73af3cc0a1cee6c0c49a9792af5b4d3c6

SHA256
189619a5411cc3115812e9d72a511f7c46196ad3f7a0bb7ac8e9df956040c3b3

SHA512
70b0d85cdc6409f84efbfc12b4e4f56e1c7e496423f62ded4b75822b3288d33347ea4ecee2aaabd498d322b6df535f13bc32ad9371610b98dfe37dd4ed380c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
baf37dfbbdf520ca8b514978b74e1b17

SHA1
e0b47506afb5be388b921293466f00a810cb0465

SHA256
b77e48acf518edb5cdfbfb2e4f425e9263ff91a3e0d706f820ec623217b5286b

SHA512
11a3784c755faa66d117d9075d7f6dd910eb77abadd77526c708c572a38bf22aa75d4d3f4bf28601d2848bcc1f2d3216e8488341fb3303a3be544731f6dc0b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
badeb0ff6f716666bc6d837285ab7fb7

SHA1
50d25149ea22e6b7d282cec2b5e2d4863d49a4e6

SHA256
2f5b6731266e47786baacf0e9cd028b873a921245d621902b6e41058dd1f7cd6

SHA512
d5d70375fede241a372a830e8da987d04fa1001b4b0c9fb16b563a8682b5b820a78fca6e5cdb15cfcee54f083af38ab0227f580af3f191d5a6d3d170dd62172e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f0f3fef0bd62537f5bc31bea2cdc0dd9

SHA1
8454f32e29ffc6160c2cd94ddec8a37424f32a41

SHA256
55208964b41598dcd9c609a99dc9fcb16bde2dda68b089f4f3e6beaa29441107

SHA512
56b235f15e60951badf8a565683665600592b6e08117401cf2f314714a2ff4a2dca1117de46f2de4e9eb7bf557a3dcd91e135402a63af2cc350681072dc738f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
54250da6c7a224b56a8e9d6e2024ec4e

SHA1
84d7c4ace95fa33165c9e6aa76c76421660eb6b8

SHA256
3f64881eb0132d6225087084cbe45ad8a8e678918a5aa80a5ad7d597f5c3bada

SHA512
c70830d65a6f25a0f8a76dcecf45f6d18fde292bd29607668b1dc25bbd6514250a87e75f2029207bb23da5de9b7d89c18eb0606fb3362c14ee489274f86a9a98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
4e4f6754e03ba8016e62923a0e76bf73

SHA1
9a4452b9acba8e8cd91b27b3f748af1df642a71b

SHA256
0bc6dbdc1877f26a8a72c004c98e97f00efad58bcb1765d89c3713b5e539a5ad

SHA512
65c435f8f5b186abe5414459940af814db9f5b8cab99367dd7500075fcce69febdf8fa5fb8f39e07608798dbe06b395a4bdc8ec4948da8e16fc2343f4e5de09f

Download Submit
C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected.zip

Filesize
3KB

MD5
99e3aa578bc9f3223ab17a1ba80c47e8

SHA1
4222f43d6ef90df324b3c3083784fa58d1bb3478

SHA256
b63a44b3a3aaacc67441eefa90c5ce912c80397fc8990bc655f84e86a8cc90f3

SHA512
a7141b3d393943d9312d55e4e6a362372464bf376cf44a7630cb944db7043c085f19b0af11cd032c6863fb9be3bd30df494082b0d87804eae0ceb5a2efad8633

Download Submit
C:\Users\Admin\Downloads\240305-1qnqqabd84_pw_infected.zip:Zone.Identifier

Filesize
241B

MD5
991afe40cbdc02f4c2b0d41ba8e609c2

SHA1
17c4a4c45768afe7a7f761d7cc473e62072e8e96

SHA256
32352ac44bf74825c8edeb104c0f6df724b96f9544bdbab3d1ba7a48def11cde

SHA512
51a2f90986202b2ac04ad38e9e8010952f0c9bdf214e9c03fc99277aff903e4ce031b473f1c8fb0672f475649f8398c6ff2dd2ddf53b39d110e4a1bc23f651b8

Download Submit
memory/3112-204-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-194-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-195-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-196-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-201-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-200-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-202-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-203-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-205-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download
memory/3112-206-0x000001DE64020000-0x000001DE64021000-memory.dmp

Filesize
4KB

Download