hxxps://discord[.]com/channels/@me

max time kernel
1169s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/channels/@me

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	discord.com
8	discord.com

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Start Survey.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Start Survey.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Start Survey.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Start Survey.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{02AEF675-1D43-47F8-AFBE-04BE4D2821D7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
944	msedge.exe
944	msedge.exe
4836	msedge.exe
4836	msedge.exe
2144	identity_helper.exe
2144	identity_helper.exe
376	msedge.exe
376	msedge.exe
1728	Start Survey.exe
1728	Start Survey.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	1688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1688	AUDIODG.EXE
Token: SeManageVolumePrivilege	2180	svchost.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1728	Start Survey.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 5028	944	msedge.exe	88
PID 944 wrote to memory of 5028	944	msedge.exe	88
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 4876	944	msedge.exe	90
PID 944 wrote to memory of 3692	944	msedge.exe	91
PID 944 wrote to memory of 3692	944	msedge.exe	91
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92
PID 944 wrote to memory of 2808	944	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/@me
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff983cb46f8,0x7ff983cb4708,0x7ff983cb4718
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1364 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16510044195423451558,13265674806081191413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\Temp1_Start Survey.zip\UnityCrashHandler64.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Start Survey.zip\UnityCrashHandler64.exe"
1⤵
PID:2352

C:\Users\Admin\Downloads\Start Survey\UnityCrashHandler32.exe
"C:\Users\Admin\Downloads\Start Survey\UnityCrashHandler32.exe"
1⤵
PID:4060

C:\Users\Admin\Downloads\Start Survey\UnityCrashHandler64.exe
"C:\Users\Admin\Downloads\Start Survey\UnityCrashHandler64.exe"
1⤵
PID:5148

C:\Users\Admin\Downloads\Start Survey\Start Survey.exe
"C:\Users\Admin\Downloads\Start Survey\Start Survey.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1728
- C:\Users\Admin\Downloads\Start Survey\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\Start Survey\UnityCrashHandler64.exe" --attach 1728 2171568459776
  2⤵
  PID:2820

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\PixelDough\Start Survey\Unity\local.3cb134172413d3e45b83943fd7e661bc\Analytics\ArchivedEvents\171078766700003.acb75ec1\g

Filesize
1B

MD5
c81e728d9d4c2f636f067f89cc14862c

SHA1
da4b9237bacccdf19c0760cab7aec4a8359010b0

SHA256
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

SHA512
40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

Download Submit
C:\Users\Admin\AppData\LocalLow\PixelDough\Start Survey\Unity\local.3cb134172413d3e45b83943fd7e661bc\Analytics\ArchivedEvents\171078766700003.acb75ec1\s

Filesize
364B

MD5
f501149a7cf45257d8b6e223e008bcad

SHA1
677c20c9c5fdbabaaedb38d92ba5b1e8fbdd6d12

SHA256
3afb42e2f7b7f0091c6a8d38e61e2ac85f5823f161d755dbb13c4189a796fc9c

SHA512
81cd1b3319f8505567928be88f434954af3379c091b8c6beb5595abaaaf8765461bcc9b4c2ab13678ef36c4083fb35b10aba6dbcb6d8679776dee10e50ed8658

Download Submit
C:\Users\Admin\AppData\LocalLow\PixelDough\Start Survey\Unity\local.3cb134172413d3e45b83943fd7e661bc\Analytics\ArchivedEvents\171078796700004.acb75ec1\c

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
cbaf24de7f7b37983e5693d650616ea3

SHA1
5a7dbf85c1472ea6c1297b1c72c569494cdfcedd

SHA256
972973d79c4e67809066d78383c21e13941648b1fdfb480ced17eead876a615a

SHA512
f2174b4852da14e0b823ba7e975005e74edc5c87d93ed2dd7b3b7bec697e1e66dd33456b508819dc1551d1df051337e23da2ddeddb260f782d307be0a405aab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
87KB

MD5
bb952ac2a041937b5f73f2fb12209562

SHA1
1469b8940600d2783f62e06efb0a143710ab3be1

SHA256
7e37bbe9c452e1ac2891aec56380a52a5e3f325350811dc7f316c4eb7f0d4ecb

SHA512
8ed8cc3da43538aef5a2ad103bff082541473bd553930a7213be951253fa3a97b965de29a0d952e7d0fdd87e938ecec80a25ac8b4b5f33b473bc5aec7109e6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
84724fd83242dd7f73c7a2500881caf9

SHA1
92739d8a77d3ab12348e77c0e4593e9946d83cb0

SHA256
3e571e69703e276755488fe8b22548bd8d70593b1497e632a30def2a2eb468c6

SHA512
7344f3bbb4f4855e7513c852c9c1d5ad12d138f474b8acc0c83cfcb01abae3895f1d0688735100d4fdc86717341a580ed001299bcfb59a29e789d1c743dc9685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c54aae7daf43a156d15ed05cb3aa6d4f

SHA1
b3cd522bc3951ce0af79065c755d0e03146a5d61

SHA256
bed5bab1b9e0fd0ea42b1e309c524c1aec09ad5435740f5834b05c806d622f70

SHA512
31a5c99d2fd1d572ff4460acb8b76f6d97c82602fa3e261d8b768adc0babc0f3f11a494e6db5802d83e668aa5b7ad7e785a7257c672e66f930b63787976710ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ebf2432b8517920038169e5e85e143ea

SHA1
d8f7fc2770ff7ba8894aea3c1c6583c2bf56dcfb

SHA256
214e83a94492e1d888a430424397cac64cf90a3f6c25744e6d990a426512cf75

SHA512
1206d00d148008b57abafc157ceb901a47c538a7de27647c18b21dfd60eb3c503abd1439ae4a8cc3389256c8320f1ad4c6ba9a722430c169f083fe4c26cd4faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e78df3816e8d1c58a973cc0efcef0997

SHA1
a6d3b68cbe57e1771f813398fabff4292b4cf10a

SHA256
3612a1d111877854e2aafe1cfa79c82063cddc2c8f2e56709bf6fe3328e0ba33

SHA512
b3858c65dd4aae1b860a8005bbd1bd10fe5c1541a393b3905e3f53e3293ec9d25d5fd822ae3ec751f8cb3c386729c79b899d3f633b2860300a2f8076bc8a8f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a005c3aa136b303b72d63ff2e68950e2

SHA1
73a3f6e692a9d751a331353ab225145f8e062c0c

SHA256
6b45b697a438fc8709b2330a90d9babd8af963e1bdc2bcd4c7b0719c8ceb77c2

SHA512
1fa48efd886e22ada488970a5209015e21047c9cebda182191839a4474945ad9bf597cc439d55ec403aed3142c265d1f3542d3bdc86f13b22e571659171b1806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c48c7aa2741e5901743c645dcc53d60b

SHA1
eb121b42651349f0c6dc7de58826cb5659ab368a

SHA256
89032a474b8593c1d21163382ce5623243d06fe5365b835dfcbb17cf45930d80

SHA512
1fc513216afa85d3d18023fca7ea7031b9a653ec3b96a3aa50eb8db4740f90db74728dd1a85f4068d2bf2031c900a0df79cc86fed8117e3dcf248974cfee2ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec390f6ba59c11d9d421101813c24535

SHA1
4db7937c27630be43e9ee51ed75bacd9445732d5

SHA256
512f462b8c131946a94659def2aeb1fc42022c6bb1a338a0db10bc36356703fc

SHA512
89fbc1210823e12bbe4d0918ccf407a9e2197fb4c838f0212b0c4e2940d62dca754dd39ee1fb7be7ab514873ab3f3cee8d47b2ee806c4266ce5be8b399a824ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0bfc5cdf5ec4fa9facf56fab4d74d1f2

SHA1
e1a46dbe9fd125a01b43696ede3ec48f86ee80cf

SHA256
82a5a20c14eaaa7a91f30efd61262cc770beec506f1664fcdd00467f80afd162

SHA512
982dbe15359d6923b28c83f3faca78caab9e54f666fbea3b4f762a39c79f7122e81bc75afc4ec5e722f431c4789ac6a0887815ac8e71dba55f5a5a3332b6657d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
368942dc99605f33a49b066bbe203c35

SHA1
2531726424b540d1ca2f6602ffbccd48a8c6ba0a

SHA256
920e78edc5431c2bc8573542a21977c4aae2c10f51714cbba7e01336a8eab491

SHA512
925ebfd3d37aeabb35f8540ea24543e1d2ff6eea7abbdeb2980834a832519b932556965516a717e598bb5cb5fcb467b655eed8da4eff8aa26d2c3600b7c2711d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d051689868aae5864b696e7d9799aea9

SHA1
99cfc2a0a60dfe4fff78a13d28ca1898d59fa698

SHA256
35a7889b3a2d5be100b61ee92f5a9cf17973e8b69ef909283949ac801e6ecd2a

SHA512
59b48a853914b70167f79527e8fd33d38aa47e4fcbe542da1f42945315d245362251eca52ae47c5ce44a723a166a23cf6d49613de4a6c30371d60679969667fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
592e97a314e88007994cd6c5eac81ca8

SHA1
273e715ae82a46a2bd3257250dabd278bfc4954a

SHA256
042bb50167b71222e4a43cc7d2b23609b660e71ed2c3f4a794a8cc183ce2a102

SHA512
d99f20b3fba7b3594fe94221e74da92be67d7a820c2109fe18fc73795cc52db46df6fc49db00141fd2597da0be442e99f12d91da8348ad9dd617e15eeb21d16c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8396d2b3f570bbd4b45fe46f4b7cddc7

SHA1
a1af5895bda0158bdcaffedf040a09a97404ee49

SHA256
8f0f4723284f2b612a99cda292353decd785792bd5b736141da9c687ce15c44d

SHA512
9001ac223281dcc368a7cceda402e79fc4645a2eafb0d5f567d7f7940825c988a0e5e2849a6c8b42b434671553a2c697adbc4f5855fc31cb66b232dfb71371ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b0919391c9c87a887bcb619d8773143

SHA1
9cfa4d1a004bc66a27d57b9d2c47a94089f624ff

SHA256
2b4776279c9063c6dba62823945370f575919f7bca4ab47ae279cf8b70327c27

SHA512
3a3797e59a59911affbe3ee94ab4e67fe6fb30523e16736946c85c089537ddd2c41a7569bf3f8412f9736cedddbcefb986d006f2438ef85c006e5e8f0f1c11bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4698c41e1f359ef9c6859ba4f7e35a8

SHA1
d65b7f06e00f533ae344720e988dd1c6a7752d9a

SHA256
7c30d3d82c648e7a824473f703990c14d3d393a8481ff3bca48b3fd6349669d6

SHA512
3ccf6a42310a964df6abd3d026abf2847fc3e65ee13137bd09fe71f8c41b6341734724fbcfa23de48331484a575e6bc7ffb84a2534057ad6f65d27918a0b0a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b15e.TMP

Filesize
203B

MD5
566aebabf3808b8780bc6608b42d82eb

SHA1
b4fca380b933969911c610f55288aa2ec1e2eb41

SHA256
c81c34192df6a74f89d0567e453a888fe42f563f08d54febda5203d2a7b989ac

SHA512
6de420b7c854b09e98c08c1f96531d0e27cc8e74230c2afb08d280bcb06f3b3e2ff1ddca0f5d043c5cc3f8fa62fd5c902fb7fca64bee7b938c6628e7ae87f16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c953ea027d318d17d4b5d3b52b958a5b

SHA1
451c3480eaeb813a3f02b5f48155879a31766c8d

SHA256
3dd6aba0e1248c4b870a2947e05afa7d7ab3b0d7a3e7fbeacd1586246d5497c5

SHA512
c465ac8d468a6e5e55744d25346a1ac04f78c862a553c9ea3dad818412e628da178fb8b3d2e5a6aa7c90c28a3064ed83cc73ed5ddf116c5f9614eb8f53d58243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
34c5bf553d2ecb2efa790f0a7695a8e2

SHA1
e178248da6f00457dfdc16e62dbe16cabdecbfb0

SHA256
11ec4a7bb3f4f6667d839cc6100bf58dd748de9e4f60829735aef239b6691d71

SHA512
bf6a9e37f511009678ba3bee3e120eefccffa276a7068e1c6d0b5e669f1a127e6fa065315cbc6b3b6c768bb343f3639f1c6737f903470f8cb8f0097d58618958

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Start Survey.zip

Filesize
6.7MB

MD5
4ed5504a2f0a4f055d810acafd7a64ec

SHA1
76921c7058eaa7b4b53009c79dbed0e7d15babd0

SHA256
926827d9852bfbfb7bfd17e148fda5afb552f6c6c5ddea3f6b149cbf4d72b41e

SHA512
36f8af3a1b46b43a0d32b0a84d4dc270c78b9018fc20790b007ea6bb7aa1d9c31670779cf50d7f7e0ca6f9fd6b9410b2ae3af0a1042f2f138a53dfff30022c2c

Download Submit
memory/1728-973-0x000001F9A9490000-0x000001F9A94A0000-memory.dmp

Filesize
64KB

Download
memory/1728-1038-0x000001F9A94D0000-0x000001F9A94E0000-memory.dmp

Filesize
64KB

Download
memory/1728-961-0x000001F9A9210000-0x000001F9A9230000-memory.dmp

Filesize
128KB

Download
memory/1728-962-0x000001F9A80D0000-0x000001F9A80E0000-memory.dmp

Filesize
64KB

Download
memory/1728-963-0x000001F9A9230000-0x000001F9A9240000-memory.dmp

Filesize
64KB

Download
memory/1728-960-0x000001F9A80C0000-0x000001F9A80D0000-memory.dmp

Filesize
64KB

Download
memory/1728-964-0x000001F99E8A0000-0x000001F99E8B0000-memory.dmp

Filesize
64KB

Download
memory/1728-965-0x000001F99E250000-0x000001F99E260000-memory.dmp

Filesize
64KB

Download
memory/1728-966-0x000001F9A80E0000-0x000001F9A80F0000-memory.dmp

Filesize
64KB

Download
memory/1728-967-0x000001F9A94A0000-0x000001F9A94B0000-memory.dmp

Filesize
64KB

Download
memory/1728-968-0x000001F9A94C0000-0x000001F9A94D0000-memory.dmp

Filesize
64KB

Download
memory/1728-969-0x000001F9A2C90000-0x000001F9A2CA0000-memory.dmp

Filesize
64KB

Download
memory/1728-970-0x000001F9A94B0000-0x000001F9A94C0000-memory.dmp

Filesize
64KB

Download
memory/1728-972-0x000001F9A94D0000-0x000001F9A94E0000-memory.dmp

Filesize
64KB

Download
memory/1728-958-0x000001F9A4880000-0x000001F9A4890000-memory.dmp

Filesize
64KB

Download
memory/1728-974-0x000001F9A9520000-0x000001F9A9540000-memory.dmp

Filesize
128KB

Download
memory/1728-971-0x000001F9A94F0000-0x000001F9A9500000-memory.dmp

Filesize
64KB

Download
memory/1728-1001-0x000001F9A4AB0000-0x000001F9A4AC0000-memory.dmp

Filesize
64KB

Download
memory/1728-1004-0x000001F9A4880000-0x000001F9A4890000-memory.dmp

Filesize
64KB

Download
memory/1728-957-0x000001F9A4AB0000-0x000001F9A4AC0000-memory.dmp

Filesize
64KB

Download
memory/1728-1016-0x000001F9A4890000-0x000001F9A48A0000-memory.dmp

Filesize
64KB

Download
memory/1728-1017-0x000001F9A80C0000-0x000001F9A80D0000-memory.dmp

Filesize
64KB

Download
memory/1728-1018-0x000001F9A1DE0000-0x000001F9A1DF0000-memory.dmp

Filesize
64KB

Download
memory/1728-1028-0x000001F9A9210000-0x000001F9A9230000-memory.dmp

Filesize
128KB

Download
memory/1728-1029-0x000001F9A80D0000-0x000001F9A80E0000-memory.dmp

Filesize
64KB

Download
memory/1728-1032-0x000001F9A9230000-0x000001F9A9240000-memory.dmp

Filesize
64KB

Download
memory/1728-1033-0x000001F9A80E0000-0x000001F9A80F0000-memory.dmp

Filesize
64KB

Download
memory/1728-1034-0x000001F9A94A0000-0x000001F9A94B0000-memory.dmp

Filesize
64KB

Download
memory/1728-1035-0x000001F9A94C0000-0x000001F9A94D0000-memory.dmp

Filesize
64KB

Download
memory/1728-1037-0x000001F9A94F0000-0x000001F9A9500000-memory.dmp

Filesize
64KB

Download
memory/1728-1036-0x000001F9A94B0000-0x000001F9A94C0000-memory.dmp

Filesize
64KB

Download
memory/1728-959-0x000001F9A4890000-0x000001F9A48A0000-memory.dmp

Filesize
64KB

Download
memory/1728-1039-0x000001F9A9490000-0x000001F9A94A0000-memory.dmp

Filesize
64KB

Download
memory/1728-1040-0x000001F9A9520000-0x000001F9A9540000-memory.dmp

Filesize
128KB

Download
memory/1728-1041-0x000001F9A1DE0000-0x000001F9A1DF0000-memory.dmp

Filesize
64KB

Download
memory/1728-953-0x000001F99E8A0000-0x000001F99E8B0000-memory.dmp

Filesize
64KB

Download
memory/1728-954-0x000001F99E250000-0x000001F99E260000-memory.dmp

Filesize
64KB

Download
memory/1728-955-0x000001F9A2C80000-0x000001F9A2C90000-memory.dmp

Filesize
64KB

Download
memory/1728-956-0x000001F9A2C90000-0x000001F9A2CA0000-memory.dmp

Filesize
64KB

Download
memory/2180-1086-0x000001E491390000-0x000001E491391000-memory.dmp

Filesize
4KB

Download
memory/2180-1078-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1088-0x000001E4913A0000-0x000001E4913A1000-memory.dmp

Filesize
4KB

Download
memory/2180-1079-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1080-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1081-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1082-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1083-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1091-0x000001E491390000-0x000001E491391000-memory.dmp

Filesize
4KB

Download
memory/2180-1085-0x000001E4913A0000-0x000001E4913A1000-memory.dmp

Filesize
4KB

Download
memory/2180-1042-0x000001E489060000-0x000001E489070000-memory.dmp

Filesize
64KB

Download
memory/2180-1077-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1084-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1094-0x000001E4912D0000-0x000001E4912D1000-memory.dmp

Filesize
4KB

Download
memory/2180-1075-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download
memory/2180-1106-0x000001E4914D0000-0x000001E4914D1000-memory.dmp

Filesize
4KB

Download
memory/2180-1108-0x000001E4914E0000-0x000001E4914E1000-memory.dmp

Filesize
4KB

Download
memory/2180-1109-0x000001E4914E0000-0x000001E4914E1000-memory.dmp

Filesize
4KB

Download
memory/2180-1110-0x000001E4915F0000-0x000001E4915F1000-memory.dmp

Filesize
4KB

Download
memory/2180-1074-0x000001E491750000-0x000001E491751000-memory.dmp

Filesize
4KB

Download
memory/2180-1058-0x000001E489160000-0x000001E489170000-memory.dmp

Filesize
64KB

Download
memory/2180-1076-0x000001E491780000-0x000001E491781000-memory.dmp

Filesize
4KB

Download