hxxps://glarity[.]app

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-ja
resource tags

arch:x64arch:x86image:win10v2004-20240226-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
07/03/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://glarity.app

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542759816848306"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2727153400-192325109-1870347593-1000\{05EBBFFF-BBDA-49BD-990E-1D1C98800398}	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2727153400-192325109-1870347593-1000\{14F362A1-5317-4C8E-BDD2-3872539D2191}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
6052	msedge.exe
6052	msedge.exe
5732	msedge.exe
5732	msedge.exe
5904	identity_helper.exe
5904	identity_helper.exe
6240	msedge.exe
6240	msedge.exe
6348	chrome.exe
6348	chrome.exe
7020	msedge.exe
7020	msedge.exe
7020	msedge.exe
7020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2004	1756	chrome.exe	90
PID 1756 wrote to memory of 2004	1756	chrome.exe	90
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 1084	1756	chrome.exe	92
PID 1756 wrote to memory of 3168	1756	chrome.exe	93
PID 1756 wrote to memory of 3168	1756	chrome.exe	93
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94
PID 1756 wrote to memory of 4872	1756	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://glarity.app
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd099758,0x7ff8fd099768,0x7ff8fd099778
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3604 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3856 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5912 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5696 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2576 --field-trial-handle=1864,i,15174625519448377772,10200372366008906177,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6348

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8f96b46f8,0x7ff8f96b4708,0x7ff8f96b4718
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --service-sandbox-type=audio --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --service-sandbox-type=video_capture --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=244 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:6424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,6125330465772186339,231587055044017516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
899KB

MD5
c3153693d433c18c4f8a98879e3864fd

SHA1
48f64ee4f5cc8b92a344043bd7b41fcff50d60d4

SHA256
7ba3592fd0158c91cf24764cc354253b70fa9fab6ca38a209aa02645e99a441f

SHA512
1ccba9ecbc5de3be3bd3dcc5ce263480704e2ae1173b20d1c70602d703e235b4e5b8847adacbfadcc2ad8723d3e0098ea384a9858cea6d1b60609f44e2b2ae4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
27KB

MD5
ce0b8d11a00256be872539d386e3f8e5

SHA1
64658a28b3b3a52c5332c9e1fdb8875411a4f9d2

SHA256
3a009c2e78435c0b5f5454d3a39090a76111f8dcdb35ae665332afacb6f2d83e

SHA512
06fd4d8b19f485e8fafabaebef5f48217d86ff8d59a1889e3a47bc28eaafb23892fe0f85d4e2165cdfbe70761fc006c0650e7304b2534960ee8962fdcef8cb4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
48e7e03483609d411b08d05fe716d404

SHA1
c2ec33bcc2800390e57d2b6b622281ff7d197e26

SHA256
d9f959741271ba475014b495bbaccbc0b11a320b6e7b6f21fe4a62622103fa9d

SHA512
e6a1c42141bb98bf1323a9288c537bb6c38e781459798206dfaaf35de71c870ae6453d37ae873cf38c1f31edffa1a0667bfb8646b1a4173d30e08c154cc2a453

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
1a6a5620be902b552115a131575311fb

SHA1
a109ab82e20fdc699a27522d3449c3472407eacb

SHA256
7d73fee2ba0f82feefe3511dbc3bae6d39ae180c8fe7dc7516c85828dad40aeb

SHA512
dc017cc46bc2ae9a6a87a472de146221de9ef3a98653aea53e18521ed2bdd4fb0e2cfe323612c481ffd2624bf43800c565deeeedb9640eb383d9cb02d5933b2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
a74491b95b6745511072142d52936860

SHA1
996b9628c278e8967065dd92300f53efb63d52c2

SHA256
1afa10095e8c0b3c0592a76e91f07ca606d047740d72ccbb782ff76098dda595

SHA512
8ea013450aad396c3e30adacdc0862b2b23265fc5b9ff176f07df44941ec3391418f15b651aad80c8ac3456d0a12208232f4d98295952de20c6aa88f4b8eab27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
704B

MD5
d68ff1122d6b48e19fbdf9044657237b

SHA1
ea8abe14f31ad999b03982f11eaf23ea33a9428f

SHA256
ad93383b95cc9e70d549dd9f966ffe21019c8bc85587f3d8d422f7d8faceeacc

SHA512
aaa89b296a45cd678cd6de209ec145a0023d2d72ceffd1db6ebebe77467812cecdf93f0d28bb1ab2e835009e562fec2d5ae4323e00c8e8d82ae4cbb44b184ae9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
88a39ad94733cecb1c12d3b2b602b631

SHA1
fa8b42779660cc4bc4971b45e0fe88ac2635a820

SHA256
902a10fa161381048f788d38347451f7299bd11b274836d647d6dcf4fe9456a6

SHA512
bc48bdc7f8d93199b686520b59418fe04971588ff26060c7cc1730f0f5ea7f3b26a336bc34128fb7a2f82fe83e47ea355879e1729cb02aee63d0602952fd5d71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bf0221f94f8bdc4912a7d07d53a43561

SHA1
5d90b3456009bb3c57e5ee9f1bc52903a96e5d9e

SHA256
d993bdaef8a8a5b13bd17ffe8ae5c0272819cd74da3aea8b407fb64565e7a206

SHA512
4cba9051085a87032712fe263aade20bc306240cf6f566364155aac2e66ffdaf32031348e7bf9a3b4ab7932ebd4359aa5d0a7c31272044fa0a98437ae405faf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c286d5b20ef8b79d40782277a33fcaad

SHA1
6acb37b3abd754639910f8d2a5752dd897fa84fa

SHA256
3ba97a3efa2ca0b874bdf36b68751238c352f537db70225633e2f37cccb47e4e

SHA512
d1381cf9033f33b2fdee3472b4de1ec9d7b386802814679766024f9c5b1531f075e7fcdc5a890bd59136145053edda76c48b82ff635cba5780175c780e90e4f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe578695.TMP

Filesize
120B

MD5
4f4e39a8b6d8e7c61ffcc13d647cee2a

SHA1
4bb4ce2a5b4d31d6e56a0ff88e855b37d05d6bd1

SHA256
2628fbb3ffaa34e89492e12bce6616aec8d97e7d703aead980fb3da0c58859e4

SHA512
07cf585a059c1a6453e9d2c15d4b850be8e80a5ce89c21dbd1521d3be034c5a260bc749ab237fbe9fe617b9e1c5b960f645de22187473e65459a18ed1e50197b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
28fc9b754b620269f490a3d5d8019b8a

SHA1
766c56a23de59ad2b38a097a41c6f04126bd8e63

SHA256
52a0acd4fa3e59ddfa9d804de2f0c386f1241121677340a04b90e93c6a5a1465

SHA512
a19f07fca8d5455796d2a23b088e4f2ba9718eba4f1b327252406f67ba5387755450e2981f532f9eceec1c465c3da7f9f3fb3b4faf610c020af4c126fd599abd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
ae03cf5bfe9f7557dc1555fa6f588dd8

SHA1
fc7ece202c79fff9eb50d85fb8c9dde0fc90de3b

SHA256
9ef21ddeefc019463f6047f739a4f7ec3b793ee737dff05dc3c1dc85c71fae45

SHA512
eb721a42068fc40ed32c6e8453e4fbe8a22b5a18279b9deecbf1568fa6c95b95b64878df6bd7ea45fe265b6820a8ca626bfbcb67225bb741f85f333d72cea6ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b206e54d55dcb61072236144d1f90f8

SHA1
c2600831112447369e5b557e249f86611b05287d

SHA256
87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b

SHA512
c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
67KB

MD5
88a552e6be1ac3978c49143983276b3a

SHA1
dbf4f4dc62a3da564b1a87b5191dc9a72a9b9423

SHA256
927121d8118a41fa3460b9ad84daeae59ea60dc9607e462b7e1341bea60da8d5

SHA512
125b13be3d209ff5cc12d8f9f12d01d271cd50c2800059241ebb419167c21adfa9d979ff6b8d88052f5d302e98090b7c8ceff4894b397168d8ba6d8a6204fb9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
31KB

MD5
bece038422ccc92d498cdb88950ed3cc

SHA1
743ef43ca2a84ec9d7a3aafd7550c3e6b0b48798

SHA256
c8f101aaa8ced4bf4d49828c264536ce42759e1dbf926c0628377b4939eabfd2

SHA512
b11014d24aec1f37ddc3160a5e15c8d17a365ee603e267405d38dd1afeb7e1df357b7ada92559ddec72df7d6e291dfce3f2b792320ae2a4f14e34dc2815933da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
1.1MB

MD5
c16e0a11f55e205f4743d14c4720d9cc

SHA1
0f9d479274a52ff9bc3e058e12ae79cccdada2a6

SHA256
e0397312126ef871ed1f1fecc36015082f5108b358dfc1b94abc9f18659e7ad3

SHA512
935ced76c409f736497eb004d79fd1be5d2231a82a87fc8d06f4fc372efef720a77104079390da4b099d173d86641484b1533b2e4cb2656d26c01bb5130d8313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
28KB

MD5
1681f7b45b3da0054a4f2ec7a77e25b2

SHA1
6c5ed34c6fa8dee971f32338b882acb214200d4a

SHA256
6f3de4a3ff2452f6c2b6ca5e9c287813885a34b999874870c5786a90f7e7ae96

SHA512
7747bc94e2851ffb1da7e33fc5f54af3f73d20a5b288e04f3b3279ec9e251017aec74745f1c7ac4846a77832e61f16057dda8a514fe5eecad379baf27149dae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
847KB

MD5
856f7d12445b1cb8f9e58347496dd069

SHA1
717fdbe58ed9a2bc12113e9bb8e66be511f3a834

SHA256
bbd2eba2952c222b951d67beadd32f1d13ba19843641815aa3a460bf4d56fdef

SHA512
2614e3f397c08907994f26ca03c2117312118aeb74b19538303d4e37a1a7208e880c429650cd3903b18f082affe348ebf805215b91198cdbc184b000da68bcef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
981KB

MD5
c3f0e69c9a91eb85ecc80b13f5304d8e

SHA1
0f04585b065c64463edf6a142c32121903f17448

SHA256
1bc0aa51211706c0843bd0d808a4ea6189dfea69da1f3fef771ca634bc1340d3

SHA512
e6fc7a52218767c680149651666293f0a0389d832f0521683ae1f9e936b346ce11cbe8f0e96a72c3363208477db4c7dd0f3ba472b39a4b854ef9c56a8b6d3a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9b98d4e60dc53518f7090881067f8012

SHA1
4dbf19090a11d6c7d5a8f895fcd4c4ff8aa09dd8

SHA256
356e191882f15ae794a60aff73e57e83b649cee8aa31950efd86781ad53db456

SHA512
203ddb0e49ac30fea0f13cd99984fc3a173c62a182f446d3a6eea1a0e887dcc64296438bc574847e1654f6efee650dd979be27e96ad2c3edbbc06cb480585cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6626e4277d0cae107b69ce39857447ba

SHA1
114d7f806473913da5f9ba2c3892ad8e9795b9b8

SHA256
7c7cd236357c20f0c8ab9f0352611e7df77cc19622610825c3bd40f6f1af8341

SHA512
e48b369486f215c17845921da44b45bcdbf82ed2514d66d02e6bb7c4073092b1309228341dfaa14e437a7eade546a3fc454124f5f73b189a924584739e820948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a713410b262225458379824bc4f40de6

SHA1
068d93e7ce71e120591c1e7377df71a4fd4d52db

SHA256
451f4320e78c3c93083e1cee4d5295c0eabb159d8393ef7b86d30a57e26ed28e

SHA512
60dab4c02c8e416ede28cdd397b4d59fb3c31fd177db2335f2d441fe02d905184c166107e3166766249f64eb1db6fa4e7bba553504185a2c7c060a379e2779e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffd342167956196eb8973e873ed2553d

SHA1
2ac9db3b2c9c693b2e1a11d0fcd630f7d8997233

SHA256
b22c418fe2ca6b51fb445638c5bea2ef5cc690e7c2c761c1abeaf9baee1b510b

SHA512
f52534deb6437374b404bba8ed8190572e99012199a482979ca9d51fac88439d2218073b6051898e85f7b86efc3f1c26b2931f86807167325696fb5eb1f24ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abbc6ad50ced9a5ca61f31451858ae41

SHA1
8b017d21413b42f4ecbc04fe1d917868759db303

SHA256
dc61733d5628113e8da99c82634441d11282833940517198946d3c20dadcdf41

SHA512
7839b1f267b4e8f9613b3f7de631ccb19121f5b4bb82e4dba3761cc52087d86e4388307fcb5d112e310409968140479536bbaf4c6169a01d110b28c398298b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78bda0f36d51003fe5e519b16527e429

SHA1
d1cdf086dfd5e2e32cfd7fc9f7be5fecbc6a6a3c

SHA256
a5c56119b230b8ac0ac344dc59a27fc2c614309c9fc4427114dddb20827ad372

SHA512
4f72aac3a7593a605c7944db493247395b056d680cea19b278dcd4477263cf2c2cc0ec6f703b4200ffee6dd1ffa42374e0acfdb36ccea7da16d49ac2536de390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
422d89d0e0694426b85d9847a8724e7f

SHA1
2757cb5c5d5cf2df7ddb237e129d5b3c6052af66

SHA256
cc025fbf29de7d836735f440a9f1b02249f613f197948022e630e3b34e2d6327

SHA512
7d07f7777e4416e2e47a77f36d9ae5cfbaf703d6bcf9422f5c975c94c984eff662af96204f411123b37e83ba0021424d88ddb3eca2379d646a237eefc6867f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
acf27d7b5648d8103665674edecb9590

SHA1
1c20ec5fd96346fa532b4c70b05eac8c5f3ce2f5

SHA256
8b4f771d26d01c695c1b512a4de244a027561092426741dce3f41803a7bdff4c

SHA512
1f3164ddb6fff5ed269f880d9105053c62f6bce48d20c1da568aaf5050912b3262d81cd811b5b7221d74ca8a648e3c12c89d09e7a12d2ac0da2e94478bbba47e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1f282f9e9c77b50bdbcc26a5a3476295

SHA1
316bef634eb1365fdae84c98a1bc894d7b250aa1

SHA256
37b998baa6deafc00035ea167a992d7605e128e6ee555fabb00178ddfcd6df0c

SHA512
f99d91c427b04f9b309b018839965bdd8787233d183f46eb27544ae8c6cda73e224fb8279bb6b61bbbfdb742b453a87544e45e6dc622ac488d4145169d65d290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f56db7230f9fb27c280aa1336b1c3d74

SHA1
3afe602d1af716e082880ff7a59296881c88981b

SHA256
4d4acfde9b9b46c8ee61421fa12db952834d35d708f8a2812006fc15e2292535

SHA512
a533cbdbeddb1ff6636ecf382d39a2215a7de60363efb64c40a5cf31123275c8bd4a5a2a83f4458425d2980ec03453038cbafab16126bdc80c2093c794faf9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48ac7096ad9e12039c49b183371b6eff

SHA1
534188d1e20f32932f0492e63c42ea20263e0792

SHA256
29d3045d8dc4229289fb2ef2b2ad5ff1c8024fb1c8bb49ae62c661aa3e610581

SHA512
3c37986d60540c3feb2575aa1f7a9bc60af381613494cd5846334faf7f067c1d14321a5209a7a066da8f6308e2e3b5939a01460c824739e8f1718debe886ef28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9cdbf6a16b7a5b1d52002f7362b9e603

SHA1
50e1b25ea18970e51b20187c8cb8f8e2dd6e7dca

SHA256
67fc1afb5a7c82edf2c8a8de438d8428d80fb7b079adf59dda5e55a1c210d934

SHA512
27ecf6b7d37967f7df8f026c9ee8a37d292a250377b762963671c4408e497a215c4de1558db4c07e59fc9ae9bbda955eb1b2fde3be4aeaccb156c5ef22762be0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
548bc4cc1c820441e2b827ad181beec4

SHA1
b7f94f5e1ef600d95546f65613d6a12888309182

SHA256
e2b63c36afb3ddb80b0d6eab30ceaeffabec071e30231069985c29ebe32e8100

SHA512
0f7e9769a4c455160f65e8bb2a516aa94cd7f744b0f88fd9b3c691e8e3cfa04a0d1cb8052e20226eb28fa5148dcf5d1927599acba81816b2252ceb3f96385e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585f22.TMP

Filesize
1KB

MD5
df5ca873ddc98d644d1cc00be8d1a47e

SHA1
c3f563df0035c40a5ff0114b80360260aae52f9a

SHA256
06a7e0494e3f45f028b46b6897695a1c5abef362009e2956919482d00f23430c

SHA512
3ea6caf380342013ea47d1c9dfbbf5fb970b15273ec14f50f136bb25ea38a709851e7b5bd06e39d7af2a0454ac847a880fdea814beeccce6f446a5da4dc7a234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ee44e2623144c6c0b52fdab477383c2b

SHA1
3e396e05775d336eb75eb6dd3636bfe822778384

SHA256
2011e90fdb7f51a7c8b97d19fa7f5213b8edb8de42d3afb35915dab6ccb252ca

SHA512
115126615c46cbff55ebe3b74d0ae831510ca6d0809b60643576bb61c74e4c3d2e47551c0d4878e45912d790f253fa6e753364da836eb901fcd8f98166ec5471

Download Submit