ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

Analysis

max time kernel
1002s
max time network
1014s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/msvcp100.dll
Size

593KB
MD5

d029339c0f59cf662094eddf8c42b2b5
SHA1

a0b6de44255ce7bfade9a5b559dd04f2972bfdc8
SHA256

934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c
SHA512

021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82
SSDEEP

12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f7d87d88a5b3764fa7b99096a16e6b6800000000020000000000106600000001000020000000d86390475b0b34ccaa87919e2da0a76fcf0ca86c61d2ed1b551c96d4ab92e2de000000000e8000000002000020000000fd372a2491e01b73d7223c699466a519d94f72eac5d9003cc9f923f172ef8c6620000000a980cb819e76093ba00deedf8a912c886b75ec6479d499f46ac8e8227391ccb540000000c5252c86b28db7acba4dc222dc7ef4c26d09f7d224d74166feade8e545c887b328ac567058aabe77b77372a7115581b1b62ac08cc41978f210262e53db14e888	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3789746197"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f7d87d88a5b3764fa7b99096a16e6b680000000002000000000010660000000100002000000082bf9dc3f7207bb655fee8a1d6b69c185c599a406a6fcf068ebbb0f8f48bf237000000000e800000000200002000000089ddb74510f726a100071ae221f5264a09d318ffcfa33115ff1605e5bdfef69020000000c6feddceff895de73576d7cb7b17205a9d091ef8471ca29fb8101f49338edc6d40000000571ea5b7758f721f3b4750646ca90509692dc5a56c8048a636b339b4546912b308aae2979a511dca6ed18bdd039e6e50a8e4a5f7c3386e9fdc7cfa217b3c745e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31099069"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3789766115"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002a75e8bd88da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0D6FBED4-F4B1-11EE-BC63-D28C415B03FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31099069"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c961e8bd88da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3244	msedge.exe
3244	msedge.exe
3092	msedge.exe
3092	msedge.exe
5084	identity_helper.exe
5084	identity_helper.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 3780 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3780 AUDIODG.EXE

description	pid	process
Token: 33	3780	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3780	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

iexplore.exemsedge.exe

pid	process
4404	iexplore.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4404 iexplore.exe
4404 iexplore.exe
1412 IEXPLORE.EXE
1412 IEXPLORE.EXE
1412 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exemsedge.exe

description	pid	process	target process
PID 4404 wrote to memory of 1412	4404	iexplore.exe	IEXPLORE.EXE
PID 4404 wrote to memory of 1412	4404	iexplore.exe	IEXPLORE.EXE
PID 4404 wrote to memory of 1412	4404	iexplore.exe	IEXPLORE.EXE
PID 3092 wrote to memory of 3828	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 3828	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 1656	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 3244	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 3244	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe
PID 3092 wrote to memory of 2156	3092	msedge.exe	msedge.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\msvcp100.dll,#1
1⤵
PID:1412

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4404 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8298946f8,0x7ff829894708,0x7ff829894718
2⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
2⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
2⤵
PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
2⤵
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
2⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
2⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
2⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
2⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
2⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
2⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6060 /prefetch:8
2⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5492 /prefetch:8
2⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
2⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
2⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
2⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13484120920196712404,11569519343607039493,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6384 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
0a34bae2824f93dc787e876c1980e186

SHA1
33eca0b4485f0d65957b1941539e9458d10ad6c7

SHA256
aba1100d29b2e16a227466463c71a2c1a40b491a4e6c96006d4f7f98ea6019cf

SHA512
035a06faa57348b582d8b18cdc60068bcfb74df6e07f79d7874884566d69d539e489f9f4768031fec8b32b84656425c084c3f6618220fa061575cf8a6bf10780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
e8244b5bb47d02457822e836fcd624e5

SHA1
71038d49d43b2cc7d20f429d8d5a76b54d60e1be

SHA256
6ef569a013e5e909a4a465558e3d94cd92cfd17555c11f9345f9ec89dcc6ee01

SHA512
2354c171666c9d26ff75cd66cb84fe731f40816828617cc34174ba3baaae0aa109a5f4eca65ee816e956a7c4ceec7afb5a148f30a2cb9a2da70f222f5f4f69ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
e0228a2135eabdf827abcea68dbf9c84

SHA1
2618cc42c3ce5b68ae1a32ab46f40cdbedadfd75

SHA256
dcd82430bb8b3f51ac5f752318ca8c133455c9129a7901d5e919e9f4b15b21f1

SHA512
17c6c9dc54355b0f06a1a9b2f8fe2c42526e4425defaaf3aecbc45861cadd03ead7a4d4a8782d5f460816af5252d3548f2ab63b8c716e8443a842e616548d85e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
b355cdcc2a2250adcae2fd8bfb73cb52

SHA1
90185529d6771cafb26b02539a0d7894be72d757

SHA256
93c9e5107267a88ecf53cee14b9c609ca66101c864de0568e6fe02f4d0989744

SHA512
2cd9e9e3ab45948173b4731320125584f908b3b59a774e87c160ec9e71550e032b6cfdaaa83366ea4fed3389f1b6b437ba121b02a73771ab1c65d7619bd5b012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
3197ffac1b8b0f597cdf24da1a13d2a7

SHA1
518bb5dc076fcc5a8ed9818bc8cd634d9c97db8c

SHA256
1f39f10c6a94e7ecd14949a87a5e2d5173ae2ac1a1e9f284251a684d0df3e77f

SHA512
1e1de8375a5205642934a2cc16f8b092660bbec6cd53cb673ecb02175bc71b859aff14d4222362b38e018c73bffd2527311eac3fd7fd392344e658237da9159d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
f2db9bbb9233d6a63feef06a81d11b9b

SHA1
9c94ca9d2860802c4c37bd26523e3660e8d452d0

SHA256
b3411b48af945b97104fd3575ef1c57c55b8807c3ea14f84c7d53a90b2f4daf5

SHA512
d67d15d910e9a152d2912e24eb46c7d938e451b17ea31494fc06adc08dd9f0b03dbb22fb741ce786c8ef03ffe87a98ef2df6eb634ee39bd1c608609a26cfa102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e6d26babf5ce933e9eee65a4770d78b9

SHA1
6328f697593465bec427756f51f6e1f0e6879ef4

SHA256
fc805136f493c322fc75b6ce0b5e7129674993e48449cefae577984e6ff50167

SHA512
ab32c81aa2625627c9d9e06071421b94bc5e9d25142c1a9b18e41239f1d350eaec50969eabe2d51cca6552604680d0a9e4985f5e811d8274edb76e5a22340dd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7acc597dbe5c50abf4eac6866c5f0887

SHA1
9d9ee7a8fc8d0a4fcfa5309b9568de300b339bce

SHA256
f1fae87d300a561a80be714b351c4541a1a2e182a1131baf2bdf30d3db7e25e8

SHA512
26db1e5a59d0d613e1adbf4b02d00f6e43d744e97a861b661376bd1ae3f6d997d0740ce23a883c6c0f54e9f6db080d9411e1bdd0c8c0188cabbe190caba639ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2294a224-db61-4dd2-baec-42fe531d822e\index-dir\the-real-index
Filesize
2KB

MD5
b323da9bf435452d6dba44c5f59fb131

SHA1
1f7c0d9e154f527bd4315f08c07bc085d8fad6f4

SHA256
f9588f8314ca5ef4833fa42037bc1150470b7c80c1da091a8fedc1a5a1f4a95f

SHA512
1ea582cd28bc61cd0df7881ccec13be585dcc2d70e9f633445a94a32874bb4b827c9f91bf7d2cc4c1d256a12ea8100a68a57d28f04011074de787432032f90e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2294a224-db61-4dd2-baec-42fe531d822e\index-dir\the-real-index~RFe5c8862.TMP
Filesize
48B

MD5
2438f19dfb02947e4fb4fa432c8d4b07

SHA1
dfd069641ebd15d270941466248550e640f358a8

SHA256
64fcbeb7d5371dfe3a3ac87aa4750d5d621c4c84f1b1ef6520c769767f69f357

SHA512
4856375034bf7a9aff126ff76b5b0a1b2d83d309f4b989fa24a81d10ad355ad0414f9e3ff0b93f6bd2fcd0dd10e864d2752f275198959a42617d490dce795f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
839d56c6fd7d8a9fb22482b7d968e7b1

SHA1
c37036a18701448cbd89519cbf76c3ee5a33dc52

SHA256
fc308648b42e8526ddfe68e48fa5a9bf859c48fbada2b3dadb7366bc8d1c1e23

SHA512
3e322f680550c7d52aaaa3b436bfc1b497bb27b59d4bd8fdcbf249e4d8ea0428c21e0e955e536eae85d3d9f993ab76250272a1aae382ee08d6f2ad0d3221afdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
d6c192157152ee3463e4146553f0dcbe

SHA1
3bfe4c6a01f2d4c26cdd26d5e37b7f7e0f332d70

SHA256
45e32669ba8143df5e71ab80f205824c1e6c3ee8e078203018f6f7c119f33b14

SHA512
f92258533bb2887e96fddd7f0176dac217da58608a2e44aca89f5d72d52d2e5f2711076c2366ba231b6edfcf0974f3dfe57d05208bb82fc974e0c4c54f3e8a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
84B

MD5
606203fa5353bb7ad1de159c8ce11d87

SHA1
308824b5748251b052ede5e1aef5778fdc502b09

SHA256
89184282f13e0e5565f2383fcad30a5c98baf7c020d0cb13439cd7d4b136e8de

SHA512
cb352b0aedb85e892927f645350b1148a8a5a468804d7f1afd3863d844a2d97b9cded317a80095f94295905e0f0ad124496a25e4e1366c379a28702efab634d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
10157d0531b4cc321566dbb0e56495f2

SHA1
df2762c7805da57158622d1842f2092f23736a21

SHA256
d71834b9a7c542858bdd84f074aedff07a004467d88293ca26302e5a3e0a22c1

SHA512
311693486348c598da6ea83bf6861f1fca7f7156a3ffa2a2aa481f26f6094aa789247e9d187410fbdedc115a4445111c23d8abe482b94caabecefaff4de9114a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
76a10ba2785f267bd588683422500c32

SHA1
965bf4765de03c75695c53384f05e6c71b34c6a8

SHA256
58f9fefac02a2b26c0e2e31700ccd7e6b4e032372034cdab1ef75a5d917590a0

SHA512
8000a3e94c651792ba1b4438dbc0db8efe812e176d098fcc52c1d5c43acc06907bfe749c75bbb401ae2304932e70f16438f4f408fac1accc025df5b66b39ac9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c3f62.TMP
Filesize
48B

MD5
7f54f904e4052f297bb30806ef5f28df

SHA1
68572cf22ca396f05784d19205f6ce55ceff108d

SHA256
f540a4b9c5fe43991cc16ed7c534ff38fefe7723497c0a2c53bfe181563fe6a9

SHA512
cde1f86c3f818693842e01a5423acdcf1a7189941173e1e3dc446590c88c0cffd099e06264c57051dd1d7db241989a10d30a0e0ed15cf639ca2d3ad37d412b41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
7c3c9a596c95a6ee3cc770f4e3a7b51a

SHA1
b16c1b329eff9bdbde54628f43f44a90de43b5c0

SHA256
eb562e0c9f0dde0babda6b1357c989d49966122c53b268da12f4756b544616a3

SHA512
c52b3f6ca13f108d849dfb0a208a449504f1b83c1f1144b0b8681c97e28b657d70f5a1ab7db3e9f10a165087fbc624eed249c746372d5febad7fe82b4f9fdc89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c267b.TMP
Filesize
873B

MD5
a44e600ea367b19e5e08e98122f3f790

SHA1
b6dd6cc7dfae82bd9a33307d54a607a75064b7d1

SHA256
87dbff26e99b65c42a3e6aed2919967b8a4df346900cee68680609f074814930

SHA512
b3643632756d55315caf5655b4fc4b6c7b64eb324832ab3c29eb1bd5ee6d0ccf3452ffaf1fa4073868859d89ffd0765d3ebb83c78cea352069c1198ad6ff81b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db75f8dd-07b5-4e9b-b423-306843268a7e.tmp
Filesize
6KB

MD5
625382d70cbea823007477399ace8b64

SHA1
ba961f6fee25259ba849a84e2959c0e708d48b4b

SHA256
712a7777110e9dcc4e07cf3556be389159fc0c993f4d6283f940d1dad39e740e

SHA512
803a5863dd5e4c72d26ca7549872268463f00a26de2d99a7bd6a0975546b6d27318959d0210dc8217238e9baa211096dab1689f12856d457f83248e6caa05601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
24b39106de4f87d27bdc6fa24a2eb3f9

SHA1
1ae35f4987dbc01786ceeaef9d446cd860df7599

SHA256
3816e05d79c931bdeacad4cff18c1c663622ee766a01818f45d2384b6611d22d

SHA512
02831d929b85282d59030697361140fd4d4b8d938930d1ce4899a88be28f6f6ba3d72f1d4cab2591514f036e502c98ead336851ae116b44d049e82a76ee054f3

Download Submit
\??\pipe\LOCAL\crashpad_3092_QYCEDISEAXOFSZRZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit