hxxp://google[.]com

Resubmissions

08-05-2024 15:30

240508-sxtasabc6y 10

08-05-2024 14:27

240508-rspw5agh4x 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 14:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://google.com

Score

6^/10

bootkit persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
144	camo.githubusercontent.com
171	raw.githubusercontent.com
172	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-877519540-908060166-1852957295-1000\{2D899D8E-5FD6-4933-AECF-670CB5C6CFF6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
2464	msedge.exe
2464	msedge.exe
1368	identity_helper.exe
1368	identity_helper.exe
5892	msedge.exe
5892	msedge.exe
5772	msedge.exe
5772	msedge.exe
3444	[email protected]
3444	[email protected]
3944	[email protected]
5316	[email protected]
3944	[email protected]
5316	[email protected]
3444	[email protected]
3444	[email protected]
3444	[email protected]
5316	[email protected]
3444	[email protected]
5316	[email protected]
3944	[email protected]
5304	[email protected]
3944	[email protected]
5304	[email protected]
5304	[email protected]
5668	[email protected]
5304	[email protected]
5668	[email protected]
3944	[email protected]
5316	[email protected]
5316	[email protected]
3944	[email protected]
3444	[email protected]
3444	[email protected]
3944	[email protected]
5316	[email protected]
5316	[email protected]
3944	[email protected]
5668	[email protected]
5304	[email protected]
5668	[email protected]
5304	[email protected]
5316	[email protected]
3944	[email protected]
5316	[email protected]
3944	[email protected]
3444	[email protected]
5668	[email protected]
3444	[email protected]
5668	[email protected]
5304	[email protected]
5304	[email protected]
5668	[email protected]
3444	[email protected]
5668	[email protected]
3444	[email protected]
3944	[email protected]
5316	[email protected]
3944	[email protected]
5316	[email protected]
5316	[email protected]
3944	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5584	taskmgr.exe
Token: SeSystemProfilePrivilege	5584	taskmgr.exe
Token: SeCreateGlobalPrivilege	5584	taskmgr.exe
Token: SeShutdownPrivilege	5304	[email protected]
Token: SeShutdownPrivilege	3944	[email protected]
Token: SeShutdownPrivilege	5316	[email protected]
Token: SeShutdownPrivilege	3444	[email protected]
Token: SeShutdownPrivilege	5668	[email protected]

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
5584	taskmgr.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3620	[email protected]
3444	[email protected]
5316	[email protected]
3944	[email protected]
5304	[email protected]
5668	[email protected]
5344	[email protected]
5316	[email protected]
3444	[email protected]
3944	[email protected]
5668	[email protected]
5304	[email protected]
3944	[email protected]
5304	[email protected]
5668	[email protected]
3444	[email protected]
5316	[email protected]
3444	[email protected]
5316	[email protected]
5668	[email protected]
3944	[email protected]
5304	[email protected]
5304	[email protected]
5668	[email protected]
5316	[email protected]
3444	[email protected]
3944	[email protected]
3444	[email protected]
5316	[email protected]
3944	[email protected]
5668	[email protected]
5304	[email protected]
5304	[email protected]
5668	[email protected]
3944	[email protected]
5316	[email protected]
3444	[email protected]
3444	[email protected]
3944	[email protected]
5316	[email protected]
5304	[email protected]
5668	[email protected]
3944	[email protected]
5304	[email protected]
5668	[email protected]
5316	[email protected]
3444	[email protected]
3444	[email protected]
5668	[email protected]
3944	[email protected]
5316	[email protected]
5304	[email protected]
5668	[email protected]
3944	[email protected]
5304	[email protected]
3444	[email protected]
5316	[email protected]
3444	[email protected]
3944	[email protected]
5304	[email protected]
5316	[email protected]
5668	[email protected]
5304	[email protected]
5668	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2928	2464	msedge.exe	86
PID 2464 wrote to memory of 2928	2464	msedge.exe	86
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3144	2464	msedge.exe	87
PID 2464 wrote to memory of 3628	2464	msedge.exe	88
PID 2464 wrote to memory of 3628	2464	msedge.exe	88
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89
PID 2464 wrote to memory of 1528	2464	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe424c46f8,0x7ffe424c4708,0x7ffe424c4718
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11109887329119180969,14902253907654051071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:5932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3620
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5316
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5304
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5668
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:5344
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe424c46f8,0x7ffe424c4708,0x7ffe424c4718
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,16890579622730925808,4480297930071393774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
      4⤵
      PID:4856

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7ef39bcf58785316a37b30e02e01b49

SHA1
f6086ec134e6e99e2e559e75c809ce0f5651b656

SHA256
a915fb9c638c5ba7d81a4dd9b848a6a40e205d47a976d8ada7c0faeaf25e1251

SHA512
13275c0b8795afb585b6e860245573af3db3e340cd2ff86d7929b7917863496f09cb66bbd193a08893eba0f427c034cbe4786573312c6c43bce9f67caf200448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5501c955826eb6079bf48724d92b3b97

SHA1
21a76f072207f2142c0c8fd921565a2327d403f8

SHA256
6df7e5122f1ed8e02aabe231602ff338e4b928918d0e2ffd36cfd0f66457d739

SHA512
2c3c61a30e6a24601da1b845e0ca2a1129677c6fa6b69a8a170370242b7d337110ee2606a3a32a4730fba52e9fd773cbdf7eb94fa97c662ac3313c73d109efa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
5eea8f407fa0bf35445916855149bf14

SHA1
03fe0af5c262f4b826dd0a2fa976d09e86c44941

SHA256
c0d167d980055ed8cd130a45ac926b63572cda8235387256ee1fb759d7346192

SHA512
f69ad84076056ff58ecc0fa9d7339663dc641ee861a723fedd3afefe4dee9076ca2fb3ce82faffd347ed71d92e676e5a70d4bda07864d5f99bcd208833ea6334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
f1ed27714fa3657e4d12674008676d29

SHA1
ac86684a5c4b64671865c5dc1038977a9924457f

SHA256
0c91a4bb9d2322504ca19fd7cbbe85c5bea63be24af9784271e154b8844040e9

SHA512
fe9915294d4b90002ba4008301b909a451a6bd7cf71626156631fd0080ab71feb747c01f1df9708506b4eca25f58d34724342b04bdb28ef00184f9d89b2eb8b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
b14116a6b515d5a1656ffd5804a9fa34

SHA1
ddb521b27939cbcd5c942ba76850e3f91e93e538

SHA256
23590bdd683a8aaf7443e9f1472209293702143251c6a049e0eccec8a017836f

SHA512
95cb8b82333db0801b1bcf81dab2e0bc5d25da1f0ec592f2040d0863e702c5f05a5e07c6c1f18889592095ca70fb8deb2d7175eb61977d83532ed43f576f77e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8.0MB

MD5
e2535c835fc4c1a1098e583416e767d3

SHA1
2e612651b1aca60beaecfb78e506a0b0a73c7a4e

SHA256
6ee656374f9ab1c1b5b91d213ab3a3e1246dbbf934b60335d518b0da9ef5875a

SHA512
8afd67a26f635624d029483aaa301239f1b510db22e9ef5ad7db074deaf546cd7910746ba50d05cea5ea4356ae499adab456f7f65f2c7ee5ca0d3e18232e5b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
916b5e20ec6873b441b61ef8d1b39650

SHA1
90ecb9b4b6ca6eedc4ce510c928f617d4ecde836

SHA256
a5af1d94690cc433040c3ae27821566e897bbb6d997d1f0d661281d167503fe4

SHA512
aeb289e0039b1916140528a7c253f747c48d2b323dd8727525eb97ab29399e6d417528a778713759642ab99f9f7dd5e32e40b9ec2c5c376112157ad4e20e1042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9e43bb17d814e9eb0e79c855ee7ec9a9

SHA1
a205cc8bf4093756e8f6e889a699e11f09f991e6

SHA256
fbf3dfba9b563345e14c8fe220f68713dbceda056380a769ec417ae335127617

SHA512
1f3457d3f98a54bfe96a7bd5382a3ada7e3f3a17ec1de6ca15feba3779c10b2a467cd6b4c910ba48887372f93443fc7c83c5fcbecad5dc10a58f1c91162bd7f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
57ab060d5baa45e2c297dadc0bdf6aee

SHA1
72480b5742ec7cbb7135e37a628a5969cceed750

SHA256
d6730dc80237b38c959a94c8f821a0ed5d13927320dd6df37bcd48a9d35f44e6

SHA512
c8878c9104ea9a99ad75eb1e732c1f320eb1a3de774623ec0acf3f7ab027601ad2a820060feb7279c4434474d350ea2058aa245f60f7ebe644119d9f466c7d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
b77efabcb65325c2c449e118f15d28e0

SHA1
dd220e9e5e99f244891c142c2b2b87b82e60d0e2

SHA256
fdec83b62662610fc996a7b9f090aab9f47fa318bc1ecf140e72f6bdccf9dbc0

SHA512
a1a4bbe5f7fb84f670366790f6e92b863f45f2401bac516b9e3247c97b000000ed3f756310fbf4907139d073df917f8967dacab61490e090ad1ee272a880e484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
32KB

MD5
9bf4db38c82c9f44b67c2284532db3fe

SHA1
fc8ae8740a7de99f62fad06738cd6c6626cffdac

SHA256
b220dbf99f9e8c90551c9448c019bdcc72aa86a08e5c178b5fb86434598f3f74

SHA512
f26071c79ff0a5ef9270ca90ad860b64ecd7479543526e1ffc4231efccb0b16ba1666818170fc1f82f2ce1ae18ec25961185d125246058fe817b36d68fe8ba79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
a79ddc35dbfe9f1bf8caf75d7367400c

SHA1
a1b15a6fb880871c8036af46246db402595ef28a

SHA256
de1f108c9ef04531f3783f978c9a5ea648dd639494207dce83f861c3bb185dea

SHA512
3792ab24c78b68741411a04d5c994d08e170062cc266f5a9cc78012ccc8972ddd0a086feaed37226d1dd3f9d75771b50af132d257d92174a95c6f8b511892279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
04a648a7004c818c9056989176c2e552

SHA1
298e316bd559b2a41ea661814600728f54f66e54

SHA256
c448d3ee3ddb5fb95dba4ce052f430af252302a748e19fd21e0f41b422a05561

SHA512
1a81d6b7d9c27d5d1257831c9c173a7192cbc173e80980685cc5e6414e3f942d1f9b01a4dd0128e6cfcc72e3add1430b891f00b0df87e6bed6b56ca5a956b027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
5KB

MD5
a069d5d773e99bb35a6ed3c5bead3d34

SHA1
0608fa0e1de4dd353984eda41be2bd0d4e2c19b0

SHA256
abee1fbc7fd606da2c20810458a8096e0e841b25458570ab5cc4d7b8881e0ada

SHA512
725c3bf814053c1e98c63504801685dc69c70be487b2f7e325d566d5a11ceee784fc527532fea2a348f5c99f33722fdd2a07a0d575010f0b0143c66401631694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
21KB

MD5
a08db575888de3f372cd29b61408522c

SHA1
34441d72470de91cb6714a1df991ee2df066a2d8

SHA256
2232a8d14e9bc404211debe96db543554173f1b81019888f6c40264750783fcc

SHA512
54f1dbbcc709b29cb78e583108c885c1e02ff2db3765175b1d4b09f5356fc488629f85d7c6e78e2f4298a5ea5a42018caa7aaf8409bab632a838560e3cf4bfef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
234ce28fd2c8dc1989f98f8df2f801e7

SHA1
cecd08275abfd55dd3a452afd9862dc13a0ddeeb

SHA256
844aebe6f200020b6e2e1f24fad65a8798ed1215bfe503e40603cb9a64798082

SHA512
96afffb1b1f70f0d5062cbd5190f022aff5fc28f4e1a463e63048572ade86ef4ad1db224d900b8c44f5540ea81e518d9471097d029307d4ccaff6ebc3cbd0e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0a14396ee7c5f59ffd272d9e32e8d94d

SHA1
aee34f8163d5e69078a9a60615796d5712e1b564

SHA256
f290d93797b56b02aaffc84ccb1ae58d75bd5d24820d1895aa568ac713a2581f

SHA512
5f3d78f104bf991b066601da428b98d3a9cf34502409bd02f50eec2bf12e11c538a7b7948bba9f3ee6e9d16fd4c818255f657956ba8b3388b6f08978a05f96b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0fe6c716b71caa0fec4280f3cd221185

SHA1
8e94164c60a4853d190d6747637c7a3107dc6fee

SHA256
dc9492a43f2370bad59604316783565ac776c2ca98fed2e885c828efc70b22d6

SHA512
6b7edf9a5293964d33d896c81efe2aaa15ade4967f6ec52663d64a45f1710ee245247eec746e0c184a93676240eba4862e7af9a20f7f793cbd2a8ba55a68752c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
26617fa62ebae0c892f5c2f3b6e280a2

SHA1
b6d42388a53942b7e561ea6269403c7c5626476f

SHA256
fa41b97eb2f6a5f134549ed16595941cf59ebe23bc6a1884724716ef807d3262

SHA512
07cadb27e9d956d472c93230a562466f39980d6a5d82fed8ede9752f6ed2cc2b27b61b001a5d341947d2f92b9e18906de2ebbaa985339663b7498dfa24c247f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8b70c589079a38b24d347ff4e86198e4

SHA1
3b10a154c4139edc7ebd3a6e81ab713be661c179

SHA256
2ad5d541c5e6a6db8c1d6d599721fb9a47d2a63583aa3dced03000396b89d10a

SHA512
e290520aa55b9405b800185995d3b757771b5b8d30f587cbc0a11d880fd0b311be809c2862ca59985d360ae063c505833dd58e9ec9880138065839213ff59da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9213f3a84a9811e8f8872992250514e1

SHA1
3692e361fa66eccf927067abc5bf42cabf7f42d1

SHA256
aee6879448e0a94a34ee3baf7801646fb1917aa6b69fb45e7b89ce5a38c8c196

SHA512
7143b72941050c2e5c4d57db5e43469fc267c6d11cab1a06ee2470e49607c1460e171677330ebe49dd87dafefe5adf12b83d01c05fee2580b11491b4d7dfd690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ffefb0cba1f1236008f952f65300e313

SHA1
9b7df8c38868a8431d00bc74cfe4d73ea29ddf24

SHA256
06a0ff56de6ff1222199df364d01fb9dc17fcee22f595da10f8951cbe443599a

SHA512
8f3f021b459064be23e56c0740022357b02a23662736e5df1dee3a67a3dd4164f5aa32def248fe11630f539fc553a8cc2c63e2eb1c2e7e91ffcd793cffe52e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2131ffbd57a957f82bb3178cf9674842

SHA1
06053bcbf13e2257f3f4b70ef621bb7a5a49d35e

SHA256
eecd213561caf0f67819c1386a0846e17418aa6b9abeb65eae2cf5fce5063168

SHA512
6001d3cb0abb38fd2d9cde04fbf87f0f891062b60dddd519e2ee18cabe949ede7e335d92aef8f04b4464114f986d3e89e44d08480a5d90061f56f8494a02baa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b805118d6acad175ec190036bb846fc6

SHA1
f5055e643413b3777cbc178b39fb8254096d4e4c

SHA256
ea640096852374e0af6fced7d4c53aa676dacfc37cc5a27747e5de0291e86f89

SHA512
04c646e8dc79fdaaf9b3eed4068416c45a49554a250c32b514b9443f6a44531d5c50f6c60a2bb82461c67c1504fdc912fc96e0a2ea1554adc9aaecc05a34a82a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
418d2a521c1a4f5b2563dfd31fcc7ec6

SHA1
5234dd2087c788abf8cbd6f217df9e5fe9101961

SHA256
a816c4a502a6db2364e735db6bd1f1810f38025b3d01ce842f9018810f32d5bb

SHA512
b33d1fd74d7bb2d33a028ee5492bbd9281ee8ea51648567d20647fa5a13a12529af113ef1ec0c9861da27d540c06e67303b5431c92961dd2ee32d62d761e79c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb5d66888683cd3cc9f34d89d4417b74

SHA1
c8efab9608fa5e67e29f2aa5ab7a5568b9587785

SHA256
5fe7c6153db150908d062799127080cf6de25d3eedc95ae1a1b5d5c3b6f417eb

SHA512
7b157c045988a2f14aaa2dc034ad39e115c3e592fe5187962e9d86c3697f0653a3603d28d8b3bf570b7d91da57ecb2f3d62fc5315d1f55a08ea63c7a6188806f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4d4569c5946c62d899c2d9ba38c89ebd

SHA1
efaf17cd038ecdf2114d26450b5e46f6b755de73

SHA256
273b63244c828043357fe84b9b204936daed13a6024b78b6cfe1dbf4a63efc50

SHA512
c57e7c6a2265ed766d3b634fb15fbca1a535caf140e0dade6671beffbec7b4b0e4085327534dbf2eaff93864de5df1fbece88eeaf5b9df8078f3efbef94b916f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
8803737b75ad2eb6c71702359fd6c173

SHA1
2ef79e0e25cd08c3fd77a1587caf789a2d73ce19

SHA256
54749a47df0d72e43bcb476d42a583043f705335b4ad07e54c659aac1dbc2804

SHA512
5f245f687b4fbc676695b65c63219e5f0e4db0da545ef5aa59f0d268e831cf15291fa297836bb396e954b18cbbeba3cd3c69f95e0c724ea4833cc292d5e4c33e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
765131ddefae00de1ff6f1164d073021

SHA1
72cbd76bfade9242df913e7dc75f4074e8891a48

SHA256
7542828121270f85deb2612515e87e5d79449e1f1b669c5f957abed7235063eb

SHA512
6c1bc244a0da08a0033b8a1ec31275b22de7e62a3fe8498ca97baffa57d7015d11954f705bd362a60e5d0ec5d3d5d3433d21e57fbb0e051d97ee61e93ac521f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13359652071591996

Filesize
22KB

MD5
57ca2a1d6ec71375411d5c54eddffcd7

SHA1
9811a8a9bd695a4e8f08472e892084ea1fcde29c

SHA256
b9b762d412a56b622573c1765ef21d990deb372bac26416ff23234f353923004

SHA512
6d2dbf4acd779b76ced9510b4637a98a09e64986ffd6fbee2a62fb532d54226d6493694f496c9375f05f175563e3a36df89fb43fdead05eae2945e7ba234d26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
304B

MD5
5856306ac8e1153d43412414141b64fa

SHA1
044ac221ded525d4489b28ecd77b118173384260

SHA256
39fb8c08dcb0427f461f35da51b3aa2968cbe35583ce8393a65ccee7a8027c0a

SHA512
32c4683a36112fec44c668897131d93b528c62eb82bfddc53118a93f5510101500492e6bfe77d6dc0ee8ddc3b23eecaf5469e2dbc2cbafaf9b1250127a515d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
3582526c4ee0493a3add007ebe264805

SHA1
4eaa7492177081a13397a5363eec6d92498bb59a

SHA256
817a406b9ec5eef20ddcf4a6c211529abdc3c67afa9e5ae860a9dd95710e69e6

SHA512
717e4b1c1a63722e200d4c65b321d6f585908dbcfb1cb9fda4716adfe89140d32225a97dc985e647f348dfdec4c030ecb3384fd2e7204e2b676030b4b8bdb08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
aa7908e96b9bf1d36ba40b2ddd5031af

SHA1
cea4fc2d4123b6f82f215b4c8a54dd6d21739523

SHA256
88d4cc41a7c8141acc98e3086e79014045725886ee15838a2ba35aa89ee06d52

SHA512
0c36ee91594670040a2a68241d049f4da7c0aa668eebdb5dae9dca13c05a29bf680f0ea9a059aab6a79d7cccca8f894bafae7915c37a694a10095f252e7f8b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e0718e12c53ceb492663887dfbfdedf7

SHA1
21e5ed1f68acdac5158164258eff36a65e391816

SHA256
52964c732a9bdd47fed19b065af39ba64bda738e68bcd01b5a0748847d7ad951

SHA512
d3c2fdb331f5d31bd835b2f98a66c029e0a37e7d603b25761cd69c79e57a40a43009f0f5366137d142cf1a04ff570ed6923769943ddef11238964a12b3dfec5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
26ed5d0ad8c2c9fee11532571609fcd6

SHA1
192ee98e406e5b9b55ee8e5d223f1d735aeec366

SHA256
c59f169283738832518f242fa0358dde05b6d3a59de29ba34919e282951fe891

SHA512
d452083b4331bd7f3fbc857a4b05c93bd40ae3d47c4685cbe27593f45a2565c74120a7a0332cead9b25a081df81b58fc891e410a7e836293dc2a6e6a7f7d82c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e4c8764635c8469dd95779e1fe6024cb

SHA1
e11bb4dcd5fcb11ee4d8b12af58c9e93c0e94bba

SHA256
d349ff1a599d9f559452236b2d1530a8d5601c771887f236f72d5c7cefe0c15e

SHA512
b7707adc4a784be5f3e260563afa63d4a48c551b97ea0c22ad8dcfc1fcc92720f2864df90b70c623a010cc4768762a98947d997eae81304e63087a46c1f8bd7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
24038ca0ff8138619eae8f3630de0e38

SHA1
58c935688f76d0484c76d79ba4ebec838f0472fc

SHA256
3acfbfb22d34b4f035e221291e4bdde8daa2bec45d69ace54122bd71e0c12907

SHA512
fc01d27a04b0bbfb4f942e9019c8be6586f8dfce4242f1a8952fcb9f4c563463facdfe9344a61de7a3c8a114cd7cb27a4fd73731f5b793574d9c1a8d44fb7096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ac6c.TMP

Filesize
204B

MD5
0bf9d3fe8027afd88446ae926fe9dd99

SHA1
d412eafdb679baf88976e73359df2519e8baa13e

SHA256
2b31ca4c26c48f3bc8ebd002245c109093050dc84262c16e6d824488a5682b11

SHA512
6808aa9604adc21b51d61bb6df6253b40b01349a1cad943d6997b365bc62df2aa3ad9bc7e341b0228c39814f1f8e339676e585cef8f7375e8a8293778a5873ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
da2b59fe02e0500e189b868a1f68566c

SHA1
db0d7c25d1cf554f33679e30207e1c5ee23677c8

SHA256
1e29d5511a6b29385d8739d06bf8f28c8bb72b4c7320fe901c5cb7e6a1a90ba1

SHA512
f24604a41cc881affba726b923cbadfcea5112608d4ee575cb944ae07c682b2b3e03fb6ce570b0e4e8e9c46b87594c8dfee8f5c51e4a31d71a05652b34a0b55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
c8ce4831c9beac13d3445c2a2af8f8bf

SHA1
da7e93f83cb66072bb40ae274f5c25707b53b1aa

SHA256
00536a2a648ba6521b2631b7b7e7f920f3e9731edd7956783b71b39c4f7f5ac0

SHA512
e798d133c4d2bcb981f5f7dea4823ee499e90ec1a005d920212dcf617b78aa33a5ad0510d47584179f2735cebad3682ca7a6af0c59d0d4899fb44c38703cd4fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
80KB

MD5
c66c37378818594fcd7203f7d932f9b2

SHA1
715579402ac7ebeb1de8b2065c2c2b6ea4314718

SHA256
62042b4c8b7d2530e4295e9d5f5e726a7a9c47a68bb34148725bfb5de181c93c

SHA512
cae85823b0c594e6009812f89e42b533b8a25974b0519e06860442b0cbe15a44bbf352142ebe74ce09d3fddbed11e33eb2365878b595f4397c7e73303f2872e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
2KB

MD5
9778ac1143d481fd75e61943389948d1

SHA1
7424f82c644fe7d0d0de125e955736b784a53686

SHA256
c9d7bc776be7cca8d63708020d35a5e7e857ceab6bb7172a976c2a141abbc1ef

SHA512
f4efc386e032ce93b260f1e74e61200b360e9b7e99a2fba11cc5ebdd293a3cd7f967386a3b13eb56dea0f8c72d3aa1749ed94cf965acb16eb9c5baf686e8eadc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
2449f62a36e5889dfaf0dbf7e5511ada

SHA1
fce16aac09d061eb0bbf0ce6d95715c63dedb66b

SHA256
d528c15f4c77cbef6a15e67c58c29054b326ba4278454c716b77a88817127e96

SHA512
25ed69cc437dd01932233c91b4a79d47e6a9d55ceffd33d75ddaafdc631fab61b848bfb5c4a6b6ce97d390c852f4175ee49932d0e598afc24ea38948cbc194ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
645cf8a99d936fc32b21eec48e3ec087

SHA1
7943aa2953e3a6e383d5e3ea9e00e2b1b75d5d3b

SHA256
a8cfd1c400bee5a5edfd0153b64ac94de5799d8e6914a4c26a2e0bd6a0ba4b3c

SHA512
b282a7621e713955931d789b1beb4b2fba2c97e88b96d8da8f47ca82ca0c13047d32523892689d25ec9470639d45c0a46eefd8c68b89827daef167f9d1f20169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
7bfc513f0d66b5e2dd2ff6a7075f32c8

SHA1
739e474f4a6ee2653c641690ddbc352c555bc9eb

SHA256
d484129aa8f516827cfcab998c9c56f326462762326cbb81cb8201304bbc6bb9

SHA512
bbfd2f7b9697f853d0c249f3d0729def2421fac3173d2c7a3ced7bc57f9ab5daaab8f1846d3f29e5b33e2166c47184b4a3252775dcbf9b7b301c41bac04985c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
16976fd146a1b01477f091a3c27d86f1

SHA1
7eb740f67090276ae54798bdede3e6ffca2a3722

SHA256
17d9f186029b55a63beacc1009669abb8a426d71ef1515dce6f0eb2fa63bb2f8

SHA512
6d4c1c9b0204f1966a9ad8a89402bd5f4a147ae1b05d2e6052fb87fbd6d7c351833dae2821816bf4e61c603899a7f200a581a3dc7f66c7421c09636d839adfeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7a60245f6de0898c97b44725b9837a2c

SHA1
c1c405efff0f2c2cc8f9acfa0229791b9d5b6de4

SHA256
2b55c73c6cc48f9b28072b995ade83f8967743ee50d4798451d8388796d3cc48

SHA512
82e09f4d38e308eddfe91e598dbc1ed0307547745a2cbff362d630698dbe4762ee59928110aca6cc86c48191d48ce63256a612986e2e44e781999a579e3d37f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be4f15fdd2ca1e6b211867d618eb73ef

SHA1
01eef7408c84d342b87efeef97092d1f0b6a7f5a

SHA256
16efce455addbbfd4572b678c654a2993c865094f7f3bbe8f894e70add9e1d16

SHA512
72a8a94ae8fd8e62f55b82a86a6400f93fe688b42cc2c4cb5a602b3be79662567bed902a23ac217946f27dfc0540aab5fc3e081d2319f32bb74d23b4361b4da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6948e8251ada5ae012a83a53eb60cfb7

SHA1
f7df60081d9bc883092e094fa50a22c544278ff6

SHA256
f7e327fc6afb5f2b7f09cda21262758c28233e15c31e4d9bf7f1e54b06df196d

SHA512
db98799a3abd0d5dea44988d35c34515b79d456fb0a4e5b3524599fda6d65c76522412aec0d3a888167e597bfbd342fa2252075e8a74dd0618df049de3a4684d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
64bea676c22b0c8db0e49e0f51c9756e

SHA1
6c2b1b77d3e1df58cf17c8b47bc15e930c81f9e2

SHA256
a8cbe6734252b6f4a12b3e49eea5e61cf0302d7af3a2c7ddaf049a881ee387cd

SHA512
9ee29f4855e5bb623b28200a0f40eaf5039b0a4f41f90a4266525b40d227b2e6728fd0349b1f5f75272f87ffe8aeffa9cbecb1ac3e17fc55d3d945f813ff90e2

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/5584-707-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-696-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-708-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-697-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-706-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-702-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-705-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-704-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-703-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download
memory/5584-698-0x000001E01B460000-0x000001E01B461000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads