hxxp://anonboot[.]com

Resubmissions

05/05/2024, 16:53

240505-vd18dsfc6y8

05/05/2024, 16:50

240505-vcdqpsfc2z1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://anonboot.com
Sample240505-vcdqpsfc2z

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3571316656-3665257725-2415531812-1000\{4C34DE89-472B-404C-BECD-7D6054BF0B97}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
4224	msedge.exe
4224	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
3936	msedge.exe
3936	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1376	4224	msedge.exe	83
PID 4224 wrote to memory of 1376	4224	msedge.exe	83
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3132	4224	msedge.exe	84
PID 4224 wrote to memory of 3036	4224	msedge.exe	85
PID 4224 wrote to memory of 3036	4224	msedge.exe	85
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86
PID 4224 wrote to memory of 1088	4224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://anonboot.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdcb646f8,0x7ffbdcb64708,0x7ffbdcb64718
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2060 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18243998940804799366,17573873118513880133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 e562e4b7dceb1fcfaf509692904608b45beb96c2411229df3c826f2e25273e42
MD5 2574870e4df5f85f8778ae065e1f1725
SHA1 5575bcf38b5efec69549a44ef6be0f44f844a1b7
SHA512 3f2c2eb966d0cb807adb2b43c5d0a114c5c9c3447f4663479f1698d3b080df0265085b05731c19970174a24afa296cf393a3706433f3669a721e7d0dff3cba2e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024
Size 64KB
SHA256 809bafd21f2e8f5aee3c5b002d865086ce84e5cf4dc4a18c2e6d9f7ad88bbfc7
MD5 3bd6e8b735a61d32c66e6c3750e903c3
SHA1 682c567a2bd2530afd794f5999030a03f56305c1
SHA512 875969bda2db5d4199f5105f49e50268b5aecc1285d7d86c2e8fa1cab1986de727b1fbd8e673244596d0ffe10a3517f0b8827fda4df6bfbc4f95f0bd192438be
SSDEEP 1536:1He5wRphn05w1ch8S0zjHDvTwigMJoowVmZ:1fPn0y1cOSYBiowVmZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027
Size 21KB
SHA256 4d3d644e788c589b045a03b01f4a897cf0826bc0b20e25be2b856d0f5d7776b2
MD5 bca0532b1706de7579b42adecf8fe49b
SHA1 95e7ae050a6d008023f45c87e1a9937524298127
SHA512 2961ad7a86b5b4c465e9c8eab149b72541bfa77265e6105e43f4389260dabfa92fa021e90c6c2901ad1bb69d1980345aef6813928fbc5519d7b5388c6eadd297
SSDEEP 384:I5MGSQmty2avycvhVRkaNxniK3pGMCq8LSP43ZhvIiGJWhY/uVpfH:I5MGSQmty26TbNDEq0XZhvG/uHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Size 200KB
SHA256 79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6
MD5 a484f2f3418f65b8214cbcd3e4a31057
SHA1 5c002c51b67db40f88b6895a5d5caa67608a65ce
SHA512 0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c
SSDEEP 3072:OndbSQ1wbzNL29zdEqH1cDFo2jOheobJNMa9nhwzj7B1WSwjra4oJXn7LG:sd/gNL21WqH1cDF6eobf9wzj7MzopvG
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5e036e6ec8102f8de628c863a3d04090727acb3a4026e58b5661d930b45641c3
MD5 7d4f106b3f6d2ece872288b1694ade6d
SHA1 f023ce17265e2f9e8f0940c7f4ae010f9f60b392
SHA512 d0a3a5ac0775a0946d64e656fdbb01380d967928134917931664a7f2df4347aca7b81d0544fc7ba96a4b3ef95595e4237c9f49b913d14141b312aa55d51d4dce
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 8KB
SHA256 67c18d3c3eb27519b87420294283c38a60d1fbb6f34bcd3f876ff72297ac67bc
MD5 ba78e7a8ca3844d75a0b861947255471
SHA1 b682d008e30fb123f5d5dcd488aacb6735226d6c
SHA512 4099f19b0af765d8232f847edd72d446e35dcdf521f144027de0bc9dd811e3f153bce288847eb986b7c5e69143ab66ffb3ac95a16893340f7e29ab4da82b44dc
SSDEEP 192:JF4c06kJ6gbe60Ku4l/L+q1ffcpok4mWuxfwEipEL9k1J8FljVSO6MIuK9f6VMLn:JF4c06kJ6gbe60b4l/L+q1ffcp74mWuO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 bacbfa3d76fa0231e1418a7cc0177210e60f8681905a78b30b939313db15ffca
MD5 2279dd8777ed459b4f933fd0df92ed2b
SHA1 c398debc9723301af687cbbe9c5898add1b72a38
SHA512 6198cd068a0723d18a4f3122981179a40453667ad2b1cde3ef11260aa0c2b7aa552d9a9510d5e8b5e1aad5dbd5f1bba66e0a76f431a221d91734675423ab9a5c
SSDEEP 96:JF4c06kXG06bKX36VFbKl60Ku4l/L+qcXOCfjzcpoQmQBb9D6iFHFm7abkZd:JF4c06k206bO36VFbe60Ku4l/L+qcXO0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 462bee70f3de01dac31ccde0958002b40808f220eede460a192c4d5b7b0ea1c5
MD5 4ef15855aa670791e0c00ebf29303e0d
SHA1 6cdd12d90cf263b0fdccd1c839f6cc4f04a236dc
SHA512 18c83ea53979156df19e1198afab22d502abb2165fc7f19eb878dd724c5468cbab796004d16772b5f1e7c5f31079a15926e4b4ce3a610382ebb2a8c3602e7286
SSDEEP 96:nCk4xm/eQYmqw1qhwpvWMoiVmdeHm0LUWQyV+VDCziEwb:nCk5H7shGWMXXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dbbab7fbea6d090b2df3f9a6cc8f1b995ed80a18198900c714b1808285950bb7
MD5 1aee679cf8b3a3eb1f081c33ecef5408
SHA1 14aabf9ac67ebf570019b61b3318993f4b31f85c
SHA512 70cdb3a5e2d58c9f49b6e54410027b39f39ebf4157f1fe6a9a9d2aeab59eb3e1da9f0d88a2cde9bc122950abd771a8a27c170f13abd299018fabfc24cfd72be1
SSDEEP 192:nCk5v74stBWMn1uKBwwwyBp3dKCGIKY7E0HNot+qhkkoEaFxEEVcnVoSsV9Xrg:nCW4eW49zfP5VE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bd0e5d7081283a59b0ad30e4cac6e2fc0c686fe78e452ebaeab5be5619666757
MD5 cb437ea09851c089a64d1391082c8581
SHA1 aad06fde7839a6046fb57cb4836203c6190b235f
SHA512 22448cc8047698d398d6e565d4d88a1173ae3d66ccca79ae48d45d1f2e511a2223c500919efb8788aec9f20dc6627dffe11ab74b281be189a06b66760855f327
SSDEEP 192:nCkfN74NtBWMn1uKOyXBwwwyBp3dKCcGIKY7E0HNot+qhkk9hoEaFxEEVcnVoSsQ:nCk4xW4X9zfC5VQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d0673db3c0e34003e8d24fc454ddbff8145cb9b5ffccc0c59a2b78deedc7ea53
MD5 778eeb74f2eb02c8e3e738d8d3d55167
SHA1 77f243197eaa50d05995c95b75c6348d4fb1d379
SHA512 d9a44bde5b9bad2292f63224198c8c2a6cc09b4f358487e77d5fd2d72f14bdb6e91c86237152fc5bce8c759fe16cfbe6c8e201e1282b6acfea2c4535e3e6531c
SSDEEP 96:nCk4xm/enmqw16hwpvWMoiVmdeHm0LUWQyV+VD7AiEwb:nCk5Z74hGWMXXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5fa91c370717e6e58358aac1d003c7f919cf29c2f3b1187bd32db9a7ea4cfcfd
MD5 519cd6540c8e16a96dc7a6e6ac2061b8
SHA1 6c59efe8f603a92c5edaf14be6b6cf20689e540d
SHA512 586d75f3131f9cadb8fbde426820b0a541574f8d0c6904b34d71204bf195dcfb371bdb341c14abed647e8b8f2fbc60355d06a7dcb97dcc2651015241d371f147
SSDEEP 96:nCkCxm/emmqw16hwpvWMoiVmdeHm0LUWQyV+VD7AiEwb:nCkfi74hGWMXXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 382c36f8d9d1ebcfca155b872f6b67232dc7216594d4153997d12e39411c192f
MD5 eced8c0dfe3665ee2256e8562c892ef2
SHA1 2f9b6e20c695aa7f7f32b6463f86128bf6a0b3e5
SHA512 2db68601fdfe8d1cdcaba37993c68f32dc4eec464919831c8b6148a1f7bdd06c0ee45ea1bb0ec844621ce76ca18834a54a2fb78b53907c9c48b6bad4985ece38
SSDEEP 192:nCk5fX74GtBWMn1uKOyXBww3ua4yBp3dKCcGIKnK07E0HNot+qhkk9hoE0aFl9E7:nCi4IW4X9/7fri5Vy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 53f9da0418fd7a35cb87ae3aabbab83f2f7b532733d89c19eaaea5e73dbdf326
MD5 737d9271c9bab54e39018f7324ac497b
SHA1 b5813e6816c1020bb443b91a50a94eceb1bfd573
SHA512 394bb46e0eed5a7a3c4e3ae23c176a3977976c3e985b23a716525811ea6df34a0a54c489e9cf6ca927adeca27ddba049b787742c412400dc6235457257cc8099
SSDEEP 96:nCk4xm/e0mqw16xwpGEWMoiVmdefug1jmeLUWQyV+VD7AiEwb:nCk5S74xREWMPughvrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a0615d5b605c6c2fe53d997a6005ce80e264ef064119ec957af0b92dafd90eaf
MD5 b7363b9d3997e8fa3f85c8992e03f078
SHA1 ba9258a3f84a032ad2f5de4db874151f4413182f
SHA512 bf7e4beb5c13bb945b66dd5ec9c5d753b6a4012159cb91b185abfb4f838a5c46c349e350cac2e79890ff7ea7d8e86d4b95d5515758452307d240f84872e9422f
SSDEEP 192:nCk5fg74GtBWMn1uKOyXBww3uaqcsp3dKCcGIKnK07E0HNot+qhkk9hoE0aFKl9C:nCh4IW4X9/Sfr/5Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9114806b663d1be33beec80efd210718c2c898cf51f5aee6b9ef94586bb10153
MD5 951abd3237243343411e4ed263ab76f2
SHA1 bbb9c4ddbe8e4636ab42145517f3eb11eb04aeed
SHA512 3bbaf70782bf349aad4d125f3e5ee542b806b2c6e30018d7d1b22881e8a52252e41468b2663154edec79d26e5a0903e4dbff36a80f3509ee42def70322373484
SSDEEP 192:nCk5M74stBWMnlwwh3CGIKY7E0HNot+qhkkoEaFxEEVcnVoSTq2qrg:nCR4eWau5VE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 51c115e08f65c107aaf21da311e7f88f1814edeecc76719ca7a33a55f30dcf26
MD5 5164d705eda5b63c319bf808a9bf7a37
SHA1 5ae06dc2697bd56459b7e78ab3dd6a1f09a11128
SHA512 db4bfcb2b11972a1e14b34d08187581c285140123ee00df575f583964c0e84d327b2467533990e62cd190218a02919c62aaa941863666a1c0620fb66d2898738
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 57aba262545e925fdf979010ac0410f3d82ba3f68bf0d583c48bc4e91c5f5765
MD5 2e5b4e07c837c2e3bd28eb12be3bd8a5
SHA1 285176ae6b643f59b0bcfdb07f79ebb7b82c0b3d
SHA512 d6dff12f1c53ebf9fb1742158720fed3d6117e8666e7e6ecec6449147f564fb4486ea78c3d40fea16c0ce2d9c0650793a031fb140d25d9de85fd2fcbda0898a6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 012028fc065cdebb31eefff2658479c768b3628c0b793a1b067985b0e0c5962c
MD5 e8566fdb753b90504c9356fe37367b61
SHA1 d26a0d9e6ffff776ba8262ba9269d5f76b986162
SHA512 1914b7d700afea7e2ae6bddb5e4c9e62f1d2df0c1664e9020a84f13e1878a84de209f4f8b17acc77916b5e4baf7b542bab7a26a1a22df4b05c88c392fc6c7d39
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 52297999e4d882e0e81e5e33f5a8b1f5dd3ad945bc9421d4ddd8e33e0cb087ef
MD5 9cc3f78b666b8185fef7b2e413ce818d
SHA1 0eb8e5291faaff3a823791a31d9d8dcdfe88eeca
SHA512 2601d5e2a79f682557805de9bfc50832635132844d12d41fc4d662e023b70fe4912ed00185e8873b5f073a80795ff876cbc107f62c7483aabe705f312abe21f6
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58392c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58392c.TMP
Size 538B
SHA256 4da6b73fd0975220b175998760c178621fd414a7bef3f5fb4087b01434103f96
MD5 80201fea41ef9114e07dabca504f4123
SHA1 13e2124a634ad5f208e2a2082ae3868cd82a61cf
SHA512 3564c9cd32c9c5542d11dcd3ef4444d4ece07eb135271a0dd4e4939e89fee715cab1c75b4332307aa6f44b2eac257725b8b9fc37d267e2ee96a41b24bc5e10e3
MD5 SHA1 SHA512

Submit Download

bc8fad47-39a9-4808-b70b-7d397e4d94a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc8fad47-39a9-4808-b70b-7d397e4d94a4.tmp
Size 3KB
SHA256 238c35c67585fea85a98a7ef1e52fe008d3a9c3dfa2926f0e59c27da014896ff
MD5 922ab0d144916ae526055bb2866b4575
SHA1 630180b268b7d34cb188e45c91693987999e8d3f
SHA512 d7696beca4b40f1b2610903beb0474098dbce631b3962b3e15877223fee2635fb3de25c6b88d27bb2286c6e508450986d11f389b08347e8335666dd069dcdcd5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d0782cd970c33530665c57ea6404c0b14ba4a04a7a5377186b5af4adba9d0b3e
MD5 136d116f8d84eadee061f9ff8aee7aaf
SHA1 927a4d7159b8672622d717967bae7f140d4f35ae
SHA512 cf595d3477a5db1dd204ac8011cb59ed477ca4d8d5f4254a17bd2fa44ad58d9a5f3ae0c7b884045249e4a7b3e313ed13d7f271fb35add4535e14a23e4db70176
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjze2RUAez++OblfBhDaavA:A9iIxuERzA83h09RZxYXK+/XDafEBBU3
MD5 SHA1 SHA512 SSDEEP

Submit Download