hxxps://reply-aimed-pathology-ds[.]trycloudflare[.]com

Analysis

max time kernel
245s
max time network
254s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://reply-aimed-pathology-ds.trycloudflare.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 34 IoCs

Processes:

NOTEPAD.EXEmsedge.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{F0CC4D1B-D7FE-4A7F-AB5D-F628041E1B3E}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

3688 PING.EXE
3168 PING.EXE
1696 PING.EXE
3928 PING.EXE
2288 PING.EXE
724 PING.EXE
1584 PING.EXE
3164 PING.EXE

pid	process
3688	PING.EXE
3168	PING.EXE
1696	PING.EXE
3928	PING.EXE
2288	PING.EXE
724	PING.EXE
1584	PING.EXE
3164	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1792	msedge.exe
1792	msedge.exe
2696	msedge.exe
2696	msedge.exe
3660	identity_helper.exe
3660	identity_helper.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

Processes:

msedge.exe

pid	process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

NOTEPAD.EXE

pid process

4804 NOTEPAD.EXE
4804 NOTEPAD.EXE

pid	process
4804	NOTEPAD.EXE
4804	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2696 wrote to memory of 1612	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1612	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1328	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1792	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1792	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe
PID 2696 wrote to memory of 1680	2696	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://reply-aimed-pathology-ds.trycloudflare.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad5df46f8,0x7ffad5df4708,0x7ffad5df4718
2⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
2⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
2⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
2⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
2⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
2⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:8
2⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
2⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
2⤵
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3140 /prefetch:8
2⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
2⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
2⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
2⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
2⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
2⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
2⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
2⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
2⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7224 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
2⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1860 /prefetch:8
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3568 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17212394765470701587,5468784847780998780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
2⤵
PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:3904

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:3164

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:3688

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:3168

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:1696

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:3928

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:2288

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:724

C:\Windows\system32\PING.EXE
ping reply-aimed-pathology-ds.trycloudflare.com
2⤵
- Runs ping.exe
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Filesize
22KB

MD5
b12781e32738868a20094f6835c30e37

SHA1
a4fe1975fdb134a5cfbb7437ef692248dec12988

SHA256
94f2ff760122a86b25cc3fe63ca00ae19a95b2ddfdc746ec9e1504c7d310e080

SHA512
fe26fe63e08b36bb5d5e7b98433039508307a2cdf69427792a970d1e3f317229b81ae58a1e352308e87f06f35b421e3f5e766c28ccb3ef651b810790ddcb606f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Filesize
32KB

MD5
764b17e1da6963ebc217a49b77a91522

SHA1
0684a8b6fe9eaf83dc0712902ac5c9721f7e0a42

SHA256
a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44

SHA512
c056727c4a1cef069a45e030e55784c46251d3aadbedbf058b8941ff856496a7fe0eef174750d063247fe7fbad1932732c0ae06d788489f09c81a08ca287fd73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Filesize
121KB

MD5
48b805d8fa321668db4ce8dfd96db5b9

SHA1
e0ded2606559c8100ef544c1f1c704e878a29b92

SHA256
9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954

SHA512
95da761ca3f99f7808a0148cfa2416b8c03d90859bff65b396061ada5a4394fb50e2a4b82986caab07bc1fcd73980fe9b08e804b3ce897762a17d2e44935076d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
94042cb5edce6e3aa59cc3b7ca811c9e

SHA1
20f28a97697d8c95ddee7627da19e304e3982c80

SHA256
15696721d85a1c482046e1d7c5025ad71cfa3a4670a1ab10e6bee49eccd5adcb

SHA512
6caa9e02aef1391657015d784b276896861d3d2a92044aadd2974d2e5959fd3093ba0325e75339089fa92be92673770fb31edb77d7d4948c264d7821e2b7105e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
210B

MD5
6fc11020127156f86ce4f7aa463356a6

SHA1
6b1bb778c2bba3cdeebe1d78efb3fe7838c944e8

SHA256
c632a567a17b7a70f596abc2fb51d6c3f5f787f7ca9abb0f62cf26ce51f24742

SHA512
e3c16ae0aae6e8ea526a9520896c6e5d9948536079ee075419511596c9ade16e865ca33d3076e555f080b4ab04460e7d5df42c1b938d2ae4c6bdf9ea95927b9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
c5c8dcf9e2a768fd17501b1c1cd15376

SHA1
f3a5db036116a73e6a5cbd84d020cca16542c54d

SHA256
4dcda33b4b85d11c6efcaf5acca0a785fd5e645bbd01e82b35c6d5ebab2a670e

SHA512
8a159b75108ba5c93c8745f48ee8ac520fb5c107e434c5f8b60b79f55f99e148810c4c7d07211b50aa0e0e5719ff0feda0f30abea8f6852087603d8b5072be04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
b2d9a2940ff49bd2e90903b93d27a45a

SHA1
06d65290c0e0520763ea0a123b1b930fc93b5ca6

SHA256
d8ce2b249474babc61997cd52f1709f05a17fc2a0bc4717c11a3ad95b5f1f38f

SHA512
330839b33beae3699583e4671fa5aca99aa80375cbbabf9939d394ab6e2570e04fe1ba670317955f0acf4b26b5040b523b720bc84f740af08418969ca68d3670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
210B

MD5
1c25e4af77abb86d21d117febebc7bf5

SHA1
29087afad2b9e59e19730206d822b121933a253c

SHA256
eb4a4fc99f7b61e67ae47fc4513bfec72b29f7adc4bbd69cc6dc01dcaf3bfe6b

SHA512
ee80efcc117e56bf4543f37755bb3521f08a66bcfddda9a23d0ab330db139f7872e60e8e5f3528e9f659b7e70f577d6c1c37abea20dda53c009005beac894c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
648956576fb11e19b658fbea90827367

SHA1
552ed912e7a08ae3d21be4b14a1c68d79d31fbf9

SHA256
a0f6e2aa1da271ff55e4a6b539bd33ee0f3c256679e167fdc715056ffd02726e

SHA512
1798e751c1bced28fde87953da43edcb9bc00cdf07d46074e5196d820b9369dc03acb0b1e853d52991f7d0ca86675cc65ec4402103968cd1e7684c69f68dc595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
fe11a1757be770c8494ae099acac5b77

SHA1
2ec73e8612e116773f1377945f5d1929f3335e26

SHA256
9468d39e8266d76e8f340dfac9f163a3fa4fa7464fa1c012193a819a1cf1cfd2

SHA512
d1c22eea4543fb26a7fe203a5a5b18744082843b652c90751d72354328d7f4326157f564d8d437366200dba4f6cae1d3f275a8202b5bc7fd8633c2b47274e9ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
ddd3357624ded12981c8e85ba39d5c02

SHA1
fb7999002fd8209fd6bc6a9201e9efacae83a06f

SHA256
af6773d02d36c53cd497442277fc2206d8986ed3e5788f58d44f411c0fb99b61

SHA512
aef531c8ff3e39eb7f52f4ff5fc88b063fd8f9054deeffa1a3414b1674f32e7af225505f10bbf79d70c056b47bb128905dbbd425b1438213c1033a9832056162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
1bd2bdc89995a8eb0bc5bbe4640e00b7

SHA1
c08be0300bae53508e977bee3023ebdd03cca239

SHA256
9fdc25867b96b8e47cce192fda2b15265033b19e658c583931c5225695f52d33

SHA512
735d521660d26fdadfe92fc1254855702b9b4ecb70edaffa6a003a0c268a77b74fe7d8aeedeedd351f372522a317f77556b803fe35bc6b226c0034c65bf8abdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
9fb799696ad1dc767f9fe5f567ed75f2

SHA1
284f46dfb31a5aaf84e9f2e4ccd777f44ccac782

SHA256
5c98e6610da32d19b51f0e99dc4d8d890cb492b8117baec726fbb683c5e851ff

SHA512
b93b68fbd34186238a0094cf492556d86b1948b99dfab0b425f17fb5c39a088201ac75ba23e1625cd54185188f0641f39496bccfa1ca836a2a6f2fc572bb9a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4b345a550fb70a0eed57ecdb0cce5b7d

SHA1
bc039819ba850207599d55e23196ab9e6e07c2ec

SHA256
ce90e6c5fb214af1db69baae8db604eb1004a335d31f417cf616bc4c81a0eb3a

SHA512
38775e3ef65654a18dc9f1b1f1922322a8f103443f5b905c5b1dddd363036b6ab404e8ab072ec403105927127ac307ed19cfe73ef7233d123ccb583691431c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d86029ce1dc1f4f365e7bc468e0b28f7

SHA1
f16edf2500bbf5896fb18467d6159d1c6ad622ab

SHA256
d17d66f0bb4f876ba164205653bcbc2ef38d57aa6aa119df398948c4c4dcb1d3

SHA512
5c2e8547c1bad10e78c1d5de2de62c705f6cc9071d5d32351d840463a4e5c0df9ff6c8361af774f15ffa521761ab3cbaefa9c485d21ce2d46e7f12bc5d2a94cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
203B

MD5
d1cc6e88571037ea600a991192ae8182

SHA1
7d0617fb9b1ff8406f6f636227478c5a6ecbf438

SHA256
8550f3c6887c8f75fed5553f14ce16a619df29726222fc8d7d0b1add8ddd0bc4

SHA512
8cb39d0fb72fc119a69ff869eddc47a8b94a11f8ed069dd7ba04f0eec29af0069f7b695874ab440c44b64092ac784a7635a4a902b90e03e1d4a496c8ab58117b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
705B

MD5
a7f8e54ea8bb4fe27deb2b8029ff1270

SHA1
e7b22ebfec4f74c0022c9974dfda3dae424f1a3b

SHA256
6596700d506df766801cc4772cf67a8fa6e11ba24ce688e868e95b10c8be11ef

SHA512
cad9fd71f6e93cd623702a2f9a6ccf7532ee120874c670851eb9267eb7ff3af567f21094b8c9b4ba50e9ed4c9ac0fd252a17976145000eedbfb53d4b57d7f287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
537B

MD5
b9cffb7cc193b01f90522d659cb277af

SHA1
fbe1cc23a02c8c6ee4cc355c41a69e710cdf7ab3

SHA256
cc0fea9ad723ac41cdfa9c342b775d7d4e765896312d04643c7d4695a62c0652

SHA512
cfc33007d0faca63f5cd98ffbadf9832951b8de5ecd8b965b133d02329836b5cfa0e3e05d36bfce3368c4844829e61ec721d1986af5f962bf6a67f4b9ab0fdbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592cc3.TMP
Filesize
201B

MD5
33c4460e3efb3ad99bcc0d10e1c18a70

SHA1
4e799963e3e26601a4083601b9ee9b904cf9b5db

SHA256
419961a9d91f275f967e98cdff472a5cfcd9166d3bf498e82c32eb25652d4c68

SHA512
fc947c1ba574a60f5f7bef62165f459b41657c260f480785fbf43ab48b33a5ce285852a1ba7ee5edb758a7d1de43266341c842d855c10e94aa639ef314b6bc93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
36f4a78a9b9ba3929fbfdd9fc7e69bf7

SHA1
78959e877db847427f71e23c3a90e238c3c72c4a

SHA256
ffe32b0c48fc401d73705f1f577035648fd2da26b09debd12944df564420be40

SHA512
1d15645f51552afedb82464bb6539587bd79a0fad6026816fd78933c20713d6f918dac257a391e6bdf7c5bbd9522b2b5a9186cd63537fb1333cab36ec35f9900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8b819c277815902ed2d00c55e7dcbf41

SHA1
693153c6306c04fb82877df6a182854031db0127

SHA256
efc6b12349b821c6b1d19f418c7d35817b7c26b37201e9fc17b7cb3f261e5e54

SHA512
1116c5206bfa2a52163d21348ab55e447ce1d9ca568c919d3f71a1619c0b11d79645764213a94bfbf7087df135732c6fe6382ff9a26f2d8cdc06bb0547fa0a68

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\New Text Document.bat
Filesize
64B

MD5
6395d98995c7e6f709ae30fcd1dc07ac

SHA1
f2bafa6ea3505c5a3f650fa5fcac7575c095371d

SHA256
130a57a2bb71d6957427ffa4c54904cc2badfff217754d43ea1506bcff9123c7

SHA512
1b53977a1ca36b2e3bf6e1794b855519120a06d7dc525cb50c997618629312f0255d1d4d37b9b2a662e0bce5b7a51551e1624da1ccea7fcb43cf18dd51a6faa3

Download Submit
\??\pipe\LOCAL\crashpad_2696_WLKKEINQSBIQZLVN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit