aab6dfdcdba69948a34a44feb9d4b3314b13235185f7d98d78801ad4b382c285

Analysis

max time kernel
185s
max time network
183s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09-05-2024 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jhdeybuop51p.js
Size

53KB
MD5

a16681f0b505d8d00bbe5c0071da45e4
SHA1

535486e011378130e98b86e3c016dd9dca80193a
SHA256

aab6dfdcdba69948a34a44feb9d4b3314b13235185f7d98d78801ad4b382c285
SHA512

90f764ab4f85ad6e965ba57452516fe2341c5bbc6016e390e24fb1406a3c6f39f547104da9fdd689205a510007a140ea301fee9c5aa073ca5059e52802b0259a
SSDEEP

768:EdhsXLxTcdCbd8ylh9fTyfZxMFqAUegim:Edhs24bd8ylh9fTyfZxMFqAUegim

Score

7^/10

agilenet execution

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 5 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/676-1897-0x00000000008A0000-0x0000000001124000-memory.dmp	agile_net
behavioral1/memory/676-1906-0x00000000008A0000-0x0000000001124000-memory.dmp	agile_net
behavioral1/memory/4740-1908-0x00000000008A0000-0x0000000001124000-memory.dmp	agile_net
behavioral1/memory/4740-1909-0x00000000008A0000-0x0000000001124000-memory.dmp	agile_net
behavioral1/memory/4740-1911-0x00000000008A0000-0x0000000001124000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

91 pastebin.com
168 pastebin.com
169 pastebin.com
172 pastebin.com
173 pastebin.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Spongebob.exeSpongebob.exe

pid process

676 Spongebob.exe
4740 Spongebob.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

flow	ioc
91	pastebin.com
168	pastebin.com
169	pastebin.com
172	pastebin.com
173	pastebin.com

pid	process
676	Spongebob.exe
4740	Spongebob.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000603ab37bea97da017ae4f1d5ee97da0188bcf3ff01a2da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\Registry\User\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\NotificationData	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\בקרת בובספוג.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\בקרת בובספוג.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeSpongebob.exeSpongebob.exe

pid	process
760	msedge.exe
760	msedge.exe
3644	msedge.exe
3644	msedge.exe
2308	msedge.exe
2308	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
3088	msedge.exe
3088	msedge.exe
684	msedge.exe
684	msedge.exe
3576	msedge.exe
3576	msedge.exe
532	msedge.exe
532	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3552	msedge.exe
3552	msedge.exe
676	Spongebob.exe
676	Spongebob.exe
676	Spongebob.exe
676	Spongebob.exe
676	Spongebob.exe
676	Spongebob.exe
676	Spongebob.exe
4740	Spongebob.exe
4740	Spongebob.exe
4740	Spongebob.exe
4740	Spongebob.exe
4740	Spongebob.exe
4740	Spongebob.exe
4740	Spongebob.exe
4740	Spongebob.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXESpongebob.exeSpongebob.exe

description	pid	process
Token: 33	2500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2500	AUDIODG.EXE
Token: SeDebugPrivilege	676	Spongebob.exe
Token: SeDebugPrivilege	4740	Spongebob.exe

Suspicious use of FindShellTrayWindow 49 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

msedge.exemsedge.exeSpongebob.exeSpongebob.exeMiniSearchHost.exe

pid process

3576 msedge.exe
532 msedge.exe
676 Spongebob.exe
4740 Spongebob.exe
4292 MiniSearchHost.exe

pid	process
3576	msedge.exe
532	msedge.exe
676	Spongebob.exe
4740	Spongebob.exe
4292	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3644 wrote to memory of 1584	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1584	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1480	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 760	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 760	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2360	3644	msedge.exe	msedge.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\jhdeybuop51p.js
1⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcf9ad3cb8,0x7ffcf9ad3cc8,0x7ffcf9ad3cd8
2⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
2⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
2⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
2⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
2⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
2⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6360 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5620 /prefetch:8
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6520 /prefetch:8
2⤵
PID:676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
2⤵
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
2⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
2⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6524 /prefetch:8
2⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
2⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
2⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
2⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7512 /prefetch:1
2⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7148 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
2⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
2⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6856 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
2⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7268 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
2⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
2⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
2⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3000 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
2⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6020 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
2⤵
PID:732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
2⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,10240821976472784835,5911333039592128136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2496

C:\Users\Admin\Downloads\בקרת בובספוג\בקרת בובספוג\Spongebob.exe
"C:\Users\Admin\Downloads\בקרת בובספוג\בקרת בובספוג\Spongebob.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:676

C:\Users\Admin\Downloads\בקרת בובספוג\בקרת בובספוג\Spongebob.exe
"C:\Users\Admin\Downloads\בקרת בובספוג\בקרת בובספוג\Spongebob.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4740

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Spongebob.exe.log

Filesize
1KB

MD5
df46a77c07d05df7c1aa102f00590077

SHA1
86537524469c1fad8373923562374aec19b21285

SHA256
d6eabe0d05f320fec11ccca50a5d2e8913bb7f8756d18c61656e6f79322884c4

SHA512
f5ec783b868f86a4fc72cb672486bd2b11758b037d3d9d829926612936c82232c63354c44681cd1103971bd45b792f0929710ca20159cddfd6290f6250fe96fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de47c3995ae35661b0c60c1f1d30f0ab

SHA1
6634569b803dc681dc068de3a3794053fa68c0ca

SHA256
4d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7

SHA512
852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
704d4cabea796e63d81497ab24b05379

SHA1
b4d01216a6985559bd4b6d193ed1ec0f93b15ff8

SHA256
3db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26

SHA512
0f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
37KB

MD5
472ec32677a453af2c74692a60147dad

SHA1
d88b5e900d82c9bdac5cecdc1104ae46888f9e89

SHA256
28f495a706bbb9a09ca286ecba0123bde6bb8e1e0aece749eeea7c8d62fd52f7

SHA512
4140bdd439121c889e8ca3824b2aa6783318d0ed28557ad18ec8469df1cbcfa4b492f37b27124f3ec12300e3e32247bc1bd3aa9e89936228e6fba84e975beea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
be529a907c265364aea60b32d2a6b43f

SHA1
4e36681dc58aaaa130238083d0aa43d4604019e8

SHA256
1790bffabda47de3ac63c09728874fec01d03bd240361e81dbef964f8ed179bd

SHA512
37e65201a514127811d0f92dce4ca096401af92b4c90441d1e0673c1829cdf5d47f513a63f8ee1593987ac3dd542f197654423b0fe24d50aea4794001356004b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
219KB

MD5
a54050eb2a6184f1e703165402a429eb

SHA1
7c273ee43cd614151ee628cf156c13b30080d220

SHA256
c26715c4c1141af371f114277c53d744b9dcc7c610ddf2e9a39fe70ee13f14a6

SHA512
3831f5b61af37d719d19a11707450d647f728f2e24a918e428c7a5621719dfc7cb526ca9835ecea3791b47e0a655e5d581338bf670de2c1a474fea13992607ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
f218c31d967d7d050e360b26b39df4c3

SHA1
3a03e2ae75080ef0755bf1a1131640e3ed773d1d

SHA256
791410a89899725c497f590cb9138f238713dcf1b318340c18cf0682d52b63aa

SHA512
f97d6fa798fbfa27b3578777d938c327a0b1ea1379c4e0d50d640e4682fdd88dc210d30432320140d5ebdfb6ef721f0b844801a81305c877cba1d3e05d0097c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
46KB

MD5
ac83857f0497a4a0e7669329827cf228

SHA1
18ea483c966969e43a654fcadea9719a8aca370c

SHA256
43337a1354f376890cdb73f3dbaf95a8027761c574c30cdecb321096be485d3e

SHA512
6a35c50764d31d4bac07ddbec2329238cd04f2c58c00629e523ae7fc2a7d6be5d1226f8fb6c3c1043b215c38c47951a66fa8a9d4f4d6ddce7664bd1d011db2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
794KB

MD5
337b62fb0ea258fddda5ee65d3947b78

SHA1
7fd3a54169790a17dcfef9dcebe43e73a5dfb0a6

SHA256
82ff291326ee92b651f96e3d2d423f877ccae3a4bfa48357d090c3b680ebae6f

SHA512
c1ef1e65288798f49d3c77aff666a12c88c2f436609b3dcbc879eccdf828ad18dd3f341e05c29b0d313219edf29c53b3d5cf863f552b160c2c6e247fcf8fded4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
32KB

MD5
775f45010dbc42a5d5e58236c4010151

SHA1
3d0f4c8575969bdfba1da39f9b33298a25d54c36

SHA256
71e98dc894f0eaee03d7d0028f25ed4f0c86a2f64e01e3748bdb522933eade8b

SHA512
f5dd651cfd1120f2d48636dea2544f1d94ab8ab90aa297c725bb1645baf6e5d4ee74e792c3621f0bf2edfb3f8875e1ba4e23e872bf019108a28aebaa27af551e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
32KB

MD5
66301e63b3bb488b5eadd7831f4d03c4

SHA1
b70a38218bf14ca53c46289a7a31d268923b4493

SHA256
acacf083064c0ba06aeeede1a15d139c3000dce7c8b418cc811c9ab45e83cf18

SHA512
474dad6ccc63fea8fa44dd225714e8e596882e209ef845a4b898f973dfcab91e36b9a18b35ae113f12a1aca27d992a708261ef37868069969684a01728de8184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
19KB

MD5
fba47837a4f1869cece43900ea928039

SHA1
58a94b50fdcdf1b65972f37781f28c2225c10e5d

SHA256
858f19c7c56b26332a91c653c5ca46dcde48424af28a37f6a1da74e68be4ebbf

SHA512
b1f32081bd582e825232bcfd2cd81b0d7699471b42c447539965721f27acd7d49d0153a5a3b458c2f305c09da0f345eafa2572f9acd42bbddae3f5e255eab3d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
19KB

MD5
77a7756774746386ef9ead66068e5e5c

SHA1
55692345ecefd7eefe4b8b78b377c23d27281ad5

SHA256
e2519bf5591b6053295770da0709fd923a5c679c543776bf35a12412d17add91

SHA512
33222b2b55bb28e340545fd123806dc0dc3177d8e5f7e8bf209128a34680c8af6210906f2170433d4b9cd1066b88b74eeec400aab89654024359907c6e0fbbd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cfe10a711817c78b_0

Filesize
53KB

MD5
7bae7b66e19e559ae5f8c68f46bfc92f

SHA1
a3316fe7cd861cc484810a3d131e7282a04f7de2

SHA256
4feab3c0ecebae295b85cf303806a52d7b641cdf6eceef0a40d79c586bad9ab3

SHA512
7cd6ff59253abc671dc8c0bd2d388eeda5fd282ec8ade6d99ab19870efda6e22fa44737ca876a7768597530dae019317208ecba3200259c4a35bcd3596044cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
6767caa58fd6bbe0903029a25730ef8d

SHA1
07af37cea0363a8f166c41bf0952a23c53538b24

SHA256
f265ac53e62262229891d67f32f0cbc78943bc03ec32da60f251c6a906404dc9

SHA512
6dc1ccf8e7e46ded0567cd90a141de0e868dc7c746bf817b74339b02b5d91464c906bf544e796a991e7ec3b44e950c8b5c3039f6ba808ebe79734563823c65e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
28e8078726adc1881034171676e0cdec

SHA1
6b8b1f35cf46828c3586301c079e3ad754d2db1d

SHA256
91271ef19ba30a516769cb3925d2dc2eb59553ab73e3a36c6674767a4c3b3c2e

SHA512
266f6400bd01206982cf7e6ff099e38f68ac428b0669f2fd974b3d27e14e8fe78d051f93ed9ce52a07360aefd191ea97972fdeb9220d83ccac568d9fe93128b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
a89b30c003cf0060855866ad5fe1f4d0

SHA1
d2eb0056fb6475be16a1c74c11a9816c2e13b6c7

SHA256
7684591c38aa0b2e27d78f67c539fa6bbd7fac4a37cd1a8740eb1848d920957f

SHA512
d2753520586c9a2f3faf4b94ea249709ed869c79ae33449a2c7e26b7adcfacf4262081d39c9a88d5383831e891d325a94a7b03ea9785b51ecc33819f1061a918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78e83a16fcb268e339a0c411baa57764

SHA1
5b6fd52e60c9d32598e8f4b96930d48e426f14c8

SHA256
fb06e52cf9c8afaab2333f123935464ccafd03201cb2cceb5de0ede2af9806d8

SHA512
3d41761763f1fc99f5749c2bc515d3551cda685617472587caeb7cbb277dbbd45feaec05e67f0d8432a343656c477fba8c2ff080a158f61a9c4eae64c7a8bff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
40461632e85e8f22ebb542fbcd07bd4d

SHA1
d6c55c0cb1a7a424380376d0dcf34745ced439d9

SHA256
d7d08e32150df2ce743c01146585e4f6b93a638c29dd27057518855d17db1839

SHA512
c53aea7319005be63ca304bf1f287bfab252987f62a08e74e17c371cdcec92f7883d156c4719a4f397f529f54dcaad21c9db793880055e667e1183222c2146e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
32d0f208acfd478eccfcac530bee1c9c

SHA1
3f6f3c35aaae5fed3b1b116c6be3fd4d2a43e949

SHA256
59d15a144a437697e5e162ee10015c43c27be6230821a67ab032fdad93e04903

SHA512
dc9e256cb62a2fb045c2aeff62182d73a7eaf1c8bc667dd558ac3241eaa585238f7f67f76b0ab596cf4730f1b622f3f6549557679a08ec0f6b408ca958f04ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
511b6da1a682961a0ed050ea14f3ed50

SHA1
9759cb97180e9308f9fb51c99c1e54f7258b19dd

SHA256
3d8ada9e8012b9f5cc094f2b36a57b79e91408a4f8967fc2d8447b88ece0f6ae

SHA512
a9be6c7e9d8c3e117947332f46ed56f64ede183ba6135ca2d411c5cc6a053be1a6f129580e6c252de03b0920639c9c9a1cbd3e7f543a5178db13ca67d363fbb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71bf51c618ac51394758a2f667ea8367

SHA1
e62da7e2492c4f726290b04ec93d2bd2d82a9399

SHA256
814580d7b5fa06255a8ab3fc6cbfc106d762c82d09c641a4666b90b1684db9fc

SHA512
0e281d08f3baa9102ae3be1666b4c5999bbbba7654ecaed8642681bb5c90d5e2b0b5fb302f409fca3874c4c8450734e0af60ebd0d387514105cc61f62b2e6403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
65437af4099929d5fb7cb6df35481f87

SHA1
291f985712a206548018e34bb4bd752760d7bcfd

SHA256
fedccf02aa7dd964ba62ac87525d9f65a842c7be711e149731e883955287c561

SHA512
e17fc84eea2e24ff8eacf91b00b4a43655172549e16c087a9bc740de78f571676eaa10da81085040bdf2ef07803b08b08d34852f6b55d6700d5316087816bcd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
60d4fec632bc17262a1e6cae0e6389a5

SHA1
2f52a1f35cda5a09f266f98cc9ca3a31525824ba

SHA256
56a0cb175636192fdbedb7959437856e929640a2e59271695c63a68e55c9e395

SHA512
65a88c604bbb492f32ca24c5a51d978f7348a11d2988abd29874e6f8810fcf56c0d4428cbe9a38696c4e9052ed42f1045e6279e9c7f3f47bf7efc9f336bfaaf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\18879e86-a7c6-4848-a7a1-7d7e19c72fba\5b46be7f929401ed_0

Filesize
2KB

MD5
52e104fd2d586f6d4d5070fe4d06bf50

SHA1
3bb2013cfcbaa7d428125d22e898d050d6cc0c78

SHA256
992d649d25f098721cc5303746a3a18116c70948ccd2e5d772704659e682edd2

SHA512
94dacbc264fb842134e6aa342195341f91c792261623240fce71fc27e3ca7989d8b1f0c7ac1fb78d2985555d344fb51c6fc78dd36b41155fff321395c41e362f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\18879e86-a7c6-4848-a7a1-7d7e19c72fba\index-dir\the-real-index

Filesize
624B

MD5
927dec71cbd05b1f4c5671156590997e

SHA1
c7ed6749e3e0304ad0cf078aaa8e72f83fb3a3f1

SHA256
4fdb5638a5d43857617a92e8e51e2376d5d9143c92524a4b15b7a180d589dc28

SHA512
6e9097a23a57094d7eb5ac06ca875b49f3a06cba3204f231360e35fbbfd0aa1b35af01dcae2a5f84b381812d22e9b913c72b54ac159085726409de75ec7df9c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\18879e86-a7c6-4848-a7a1-7d7e19c72fba\index-dir\the-real-index~RFe58408e.TMP

Filesize
48B

MD5
5a41daca9a931550157f50740cf1cbb7

SHA1
6b5d64e97753f92a5b2d817477e2277abf9c26f4

SHA256
9807575440f786a29210e9bfb8b0bc63bf2f7317e68e339460ef06d7099bf447

SHA512
4907e205bb4a74b5c07974c489e6541667e0610c22403fc66a04011b45a01443ce36e6274429bbe142b1a7f424bade5a97a50ba773eab5cdc90f364e61dc567c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9265cadb-b60d-48c8-a20e-0efcc6eb6025\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4340687-1f42-4866-ae05-27c2325840f8\index-dir\the-real-index

Filesize
2KB

MD5
0299350cf5ddcf37a34406e4230acd06

SHA1
49ade3619727765a3fc4a0aac4b88ab7802c8a7c

SHA256
8306146e60f5ca6b1215f1d66c3b8465ac30ab6e88f9e01bbcb6e3f0d37dd7b7

SHA512
e1bc38db4eea284bc3566f4188f7be16e879c002272d73a360225686efa8a4c61f35c484cc06276e4deaf793e630e77c26aabdf59ad17b00a7ce8b7686f6d155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4340687-1f42-4866-ae05-27c2325840f8\index-dir\the-real-index

Filesize
2KB

MD5
186a30eeb8aa9f57ecc72f9aef7e6444

SHA1
ff39a42c3ceaa3edaeb5b726bf55fe44bca2de25

SHA256
341b2972cdb09e70672aa86cd7ce65d6cee3a7b737250351ac13bc362a7bcf0a

SHA512
4140fb0a6268ed01fc953c5ddcbd5cc6ade12553ca73e94a447ee0712d41e100c14f850983c0e6bbd73427c52343eee54a43dbcb4e0c99b89fa7f0968cd2982d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4340687-1f42-4866-ae05-27c2325840f8\index-dir\the-real-index~RFe57e6e5.TMP

Filesize
48B

MD5
bef001af0d300398030ef53f4285d85b

SHA1
d6e46063468b80e4a63be082aa6dc878c6105e49

SHA256
91149d92fda1d76af276ecc455c9f7c2bd8f2f482c1df31f3aa6c5460ab723dc

SHA512
968557afa4d47326cdd592c1ff9642dadb31358083855c756ec0133dc8c6d1b673f1559ab2248d83cde7dee77f70c1ccb0563811a933074fc939317ca9b3afc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
850274de80d043bd46847007db360249

SHA1
a8b383164d00182a0e5b25d6dcf0121c72085059

SHA256
ee52b1a3fcff0967409d7e63e22ac5dea06c9abe1f388a6b4de6f1505122343a

SHA512
77b31e7246b3f37b54976f4b83f6e99757befc385622c08a541fb0debd6aa2e85e75011e0d7c042bf10c1ad2584accee0cd61e040b09d29e3f0aa10a3b293eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
9b86b6d08fb569d8a0a8761829c67deb

SHA1
b356d454761d61294404b9170a4b4ffa4f04bc24

SHA256
459f43018c30b736b9726e4f98d46415c2c3b5f6acc617487b783839a9ed59cb

SHA512
105b7691f5662f94919ee2e510e66ab0a3f5b41c93d93744731003190ba2f44789405704f0d4ddaa57fe8ff97207f43023c64fbfb84889231d835b05470c58d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
f4bcf714f8190e3696109c4a9e552099

SHA1
7fbc41b5b498c2b484ce6b3ca0b54e6ddb3bf92e

SHA256
a39c6e93c29f09fdf40d7f0d7cdd2233850d76f27d86b45aee63241dcc77828a

SHA512
b359fc9fb0079e96f8e39f54663c725c42b1bd026bd15a7d7d954d2d4b5ebedee7734e96afd62f5bd9c5cdb48e31822c6a158e6970d0ae4a49fef5dfb51e9086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
6ba5a31daf6b841ede0a283a889f0749

SHA1
b13d8291ea4255c66c1e73fc2a5fb25c82c79ba2

SHA256
d37333607f06dc24cba9b4da7b30b8261069951004734c82f7d567b6eb1082ae

SHA512
0ff2d708544f26e9279a52cfbb50a08a2b864019d9b57783c5685278d30bb74005a00c2b7748b50bcfe5df4a1b3271df8335637d6852c2c3a4c4b87b08ad0452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
0677166c2d338e1b592febc6f44ba019

SHA1
d755c9af3c489360830b6eb5f7151460cc36e8f5

SHA256
a0452f570e3937bad5ffe54159a32a57e4ccf80e7d9498aba51177c67263f7f3

SHA512
53707ce9393ed79be16c5d91548752fc38d887c3355cfeb31baee1e6625a1c0ff8112d72d21de9f069ca534cb7214099597c96535d892ea7c64e58f9a33db021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
f343781a2c7c73f7cb8aa3add64c2b50

SHA1
b07d62168f7e7b00c78febd22edae7b33818b345

SHA256
2bda3e6e6339988dbce92034043384976512c3493beb1326e03cba317b073d81

SHA512
4cfdcbf9f4662cdf476d47e24bbb0e30fc563c051c7841cc24de672e675d5f56aaa26400c5b5c7206dc98882ba497a856962d5e00c04f76e9d645bc24370ba20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
fe7f76fb2a62471fa4b9cb31e4fafb70

SHA1
0bd628ac9b99e143ebbbd1cc5c60659377652a36

SHA256
a4834f69fcb6687e6bf76a0002d493e7a5c6a5f40c8c82f4913c67e4247574ab

SHA512
63a8a96f49b8496b0d4e6752e282603644f08c40e955d56c86f904c3848b3c0e4b919d11bb5e13aa435b550f10927398a9d816393e48f8b766010e0ffd50635e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
f558db0a161da85d351a4e5de0a57d62

SHA1
49eec56608237895130961135c360c6860509b82

SHA256
60fb3be4d2214c7ffb4fada4b168457bf062ea906863a8e025ab5acb47c0ba82

SHA512
020dcdfb2bd19391e4807fa43390f25c7e4a1a3dc071f461a722b4f4bd5b416507a0a3f32909e853e52bc951b3c42d1e3c702fbb233f2e469458eb16e6bae1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58397a.TMP

Filesize
48B

MD5
aa07003b05a0c85f9317ff8ec240f7dc

SHA1
847a7b893e5f21694ebd54c91690f45af46e3e17

SHA256
04a36a98571558c41397eb47ba8146b8fff9a87f6ce6257d848ce95cdc9836eb

SHA512
4193f736487e2da5ad63d020a63dac0f065a0f4ae2c62bfc989683dd192a6dbcdc6cc8058b7e28db84710d77c96628adcb1cdd350b8fbdf4b131c614105071f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43adf9577034ff3118c4320fad361404

SHA1
fe1bb5e84d577a4bee05e0d235b685be80c076dc

SHA256
49c268a3f454c7bb1221c4833fd8b6383ec957a6ffc8ad91a5fe3f4191591c0e

SHA512
aa0028c659eb36ad30a9d1daabb3043d67da47c5336747b6874e602bf9c79eb4546dd459222fc8ea9e7e89c07ea073254d8af5c33574f56be9f70b2d2def6c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ada01923cb62ea9de9030972c6044f46

SHA1
24a15222b2057ad5aa058323670fa2092b06ccb0

SHA256
c307817f468c0a493508d22cf9f848948d69fbe30f4b54ae1ae2118585f5d4ff

SHA512
74eef6349d8518db58214c7d0f30de155333195d5e073d605a1969c039d6275c481640960e2d507001a60a5f33d0ee66d24d5cfb0a525669de92177b84bd91c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3c150c0da3824b62b5ec252fc7fcf653

SHA1
53d601d17a8f01135a923d1ffd028941f08c8229

SHA256
3d09ac078c886c4d6eb97a1fd12ef5c91155bc1c75fdebdaa30afd45a50440c7

SHA512
08b767a4d2ae428484616486b8dc009392e02de327a1e54bd4c9b2bd0771ab17cd247309d0a7f87ba7ccbd869e4217cb24237bb84b99e29332d95084056f029c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
abf490652507f74a650d7841ee6d11f9

SHA1
efa892d2cd121c24ab6a869ece42f0cf2bcd7422

SHA256
3fe49119e551a7f6b2b4764b737aba36c9f95b226377c4d2a6c5232c160fbf0c

SHA512
928750a655999246f5cf5bc66e969691afc17f8a586962d2e1a784012c5d7519a7d54c41dfaf4ab9aaa2e126fb3eadecd78e627353910d024cba4a5b301b94a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
284bb563e411267ecd38d313863d3876

SHA1
be77e1487697dc438fccb7e6e1b4b45cbbde1c54

SHA256
9019a5dd0d9179db6b4a64a4c2207ba611c63b303082ec17f5246dcd21ff2e34

SHA512
356f5d2aa15ed6417c798152150df1025ef57579f238a61d39c235c38a72ab260fac51f09f135510c73a7a657b2adb375fbeb983d29fbd1df697fba864674196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b5e807a28d14a460fb2680fc349959d8

SHA1
aa829b19b859f08eabdefc3db3672d93f00ba4c2

SHA256
4e6ee3c71a29e6e88685c0f949e2bf6888aef0347ac9e15cdd062bca764be442

SHA512
c32e36ce25dd929f97954b6058a02d818ab07b224e7eed7b6af74ac655bec277d771f85125755e9c59dba315471ed4c7544b47245ab572e139be7fb2dcc4d269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6463e4043880e171e2cd27375a331c24

SHA1
a2efb308873db3d9eb577c85f75759be9e460c60

SHA256
d2dd4a1248b25e121bc181c52e03428532304b712d570e082ae096b7d1295745

SHA512
71ed4870bca2d64cb0d2e5fd76ac5117e109c792383c0e605e4b6697c4b20597e543a488508840b8f71b533063bf409381c4e2c30a96a89276e0724751732470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a1b.TMP

Filesize
873B

MD5
f05b8cb9580bce2200ace1c19940419c

SHA1
867e8e2b2c044209b3ba14e7a0478ad4548bb759

SHA256
3f07c11608e34ed93798a86cab70bfab34d0150f4df9d0da55a8c6759c544924

SHA512
998a536dbfd80a32fada69aa3e81626fe5893427051779490f2fd4737d881c3b8f2f0a3a90950b754e3c554917efae67232ff15d85826ac932245c88b1dd6239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f5922366a73bbfbc9ddca0d85e2c6b1a

SHA1
a3e1365e2355fd726d8a75729e56e745a353093d

SHA256
5d3e21d5438c808f749377064f76cd0601cdfde923f5832d782348086e33ee13

SHA512
e65e46d2543163b7a699278ea0123ce96381db7074afc58f6bcf867631bfa42256ef78b54b6185e56e7368661df10eb41476e69536f8458635b9ee4babb34c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
18ffb4fce8805b0b2a287fa8e0028008

SHA1
88ae784053d9b9eb2a500ad5e82cfd77c97accd4

SHA256
e3c527fc14e636051de82bedfc3aa16648bded8919e133f06052f96902216ef1

SHA512
da03e3fbd3143695934636fc3ea7b8512e5628bfce8dbe5ba2593f98ac9a1bbb34723399e6f6620f2fc42fb9b52879e3d853e00251017aa0b9e7c9367049569b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a767542a78fbd69d2429ace5041b342

SHA1
087088e8a355945d6bfefe1733c4dba93f72b3e8

SHA256
384eb7b0f8398ec3d64297d8791f65321664b7fff6e6de8c6292d7c5ca2df913

SHA512
7639009dcee33436a0b8cd42e1dadd870ac37cbc83b03fb1f5e02a6dfd7e47bd0df58af33abde770930b38789760955bd242cead27d0a1a24b961227dfd3bd57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
19f925aa4a50a57085086a929119671c

SHA1
5a07d430c10866ea10483aba50e7e4f45b29c4be

SHA256
5cae649e8a62e17cc70712a8f6dff8ae4a4c9ef7b46c4d1620bea29ff8e4af56

SHA512
b9e66a61e20ebe4f0e162558dff1e7c6771d925e725c2b414f173813744f1719bc394cc3aff93da04a95b639047d31bbb6e6dfa9434c87de5128e87725f43060

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
2cb9e3f89741961748d38d15dfecc8fb

SHA1
11f89dfac73dfacb194fa01bf6e7fddb38c1f6d7

SHA256
e76dcf1390543fde2ae6fd8263e90df10923df9dfe78a5fb588a50654577fd13

SHA512
20557311d13320d2f7c8bfb99e49c8af30dbcbace0faaa5101f9ea893a017a55100bf2b3c466c9d9cfe4fa8a8affcef9223a870abbcf571492fa90abd0e748f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f3bd5158cf04096dfca8647099b935ec

SHA1
443882c60605f2e6e93d36253cf0aad05863c9f1

SHA256
cdc0ce2f21504293a1590662203ac1dd02730548a038c8b99ec71e336cdb7392

SHA512
26b376aacee9018c334710e239cabbccfbfb9e9ec8f8ca63aaa0f214de0d8278446fbd6fbc7c3b0135b5256301661347cf219a8d2d493149a95230d147104e11

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
6c3b2780c66f372618590db34342899f

SHA1
f379771d6df4da8d6a7c3cc43fec9aacd9d6e40c

SHA256
a392cd89895184d4bca33b2f296256cc9b085f10b3001b20a0041926e77d988f

SHA512
f2b020c241e93ded9e17f1fddca0af4b4ef1ba9c4049ca6b79fa32ef656553cf3fd59866b09084ad6c398cc875d55d20731915b7e66091d1c9f4f98dae4e3e72

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 109794.crdownload

Filesize
5.5MB

MD5
4fad2910c184a5053474fda1e6856350

SHA1
cd4d28eed0dd7bf2bfa420c1cce7d27e02d7f78e

SHA256
cd3b294b5a55ec0e8387f9f2d54e60d47de862af8e98c4fcdb273f2509a65a80

SHA512
d926a3fa3c61b8bfdc05452006a5b3b2d6206421fda072872f3100f8dd629b7ff950f57797e963e678b71447132e02994f4e6556ebaae3ba3f8f0d3cc554fa8f

Download Submit
C:\Users\Admin\Downloads\בקרת בובספוג.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\בקרת בובספוג.zip

Filesize
5.5MB

MD5
c46d7f0c94dc3a72b4d5ff97c5be867d

SHA1
a61c0f5ce3eaff5e83913764a76c9d48d06b47d5

SHA256
f96d270e63b37615c9dd37b0628aeeaa63cfa195d222a0e7c1a3d3da32aad4e9

SHA512
6f9be88234630cffcae5cdbcb02c4130ea001012b21182d000f25fe35e79fe8b0ef7e9e0266ff477947542bb49938a2d2892cfc52dd6a84156a3eab35a17073c

Download Submit
\??\pipe\LOCAL\crashpad_3644_HSQLNLPTHZVKXGND

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/676-1897-0x00000000008A0000-0x0000000001124000-memory.dmp

Filesize
8.5MB

Download
memory/676-1899-0x0000000003C80000-0x0000000003CEE000-memory.dmp

Filesize
440KB

Download
memory/676-1900-0x0000000003CF0000-0x0000000003D16000-memory.dmp

Filesize
152KB

Download
memory/676-1901-0x0000000008AC0000-0x0000000008B52000-memory.dmp

Filesize
584KB

Download
memory/676-1902-0x0000000009710000-0x000000000971A000-memory.dmp

Filesize
40KB

Download
memory/676-1903-0x0000000009EA0000-0x0000000009ECC000-memory.dmp

Filesize
176KB

Download
memory/676-1906-0x00000000008A0000-0x0000000001124000-memory.dmp

Filesize
8.5MB

Download
memory/676-1898-0x0000000008ED0000-0x0000000009476000-memory.dmp

Filesize
5.6MB

Download
memory/676-1896-0x00000000008A0000-0x0000000001124000-memory.dmp

Filesize
8.5MB

Download
memory/4740-1908-0x00000000008A0000-0x0000000001124000-memory.dmp

Filesize
8.5MB

Download
memory/4740-1909-0x00000000008A0000-0x0000000001124000-memory.dmp

Filesize
8.5MB

Download
memory/4740-1911-0x00000000008A0000-0x0000000001124000-memory.dmp

Filesize
8.5MB

Download