hxxps://github[.]com/Noisec/Eras?tab=readme-ov-file

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Noisec/Eras?tab=readme-ov-file

Score

8^/10

discovery pyinstaller

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Eras.v7.exeEras.v7.exe

pid process

5292 Eras.v7.exe
5476 Eras.v7.exe
Loads dropped DLL 6 IoCs

Processes:

Eras.v7.exe

pid process

5476 Eras.v7.exe
5476 Eras.v7.exe
5476 Eras.v7.exe
5476 Eras.v7.exe
5476 Eras.v7.exe
5476 Eras.v7.exe
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 191.101.209.39
Destination IP 191.101.209.39
Destination IP 191.101.209.39
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

34 camo.githubusercontent.com
35 camo.githubusercontent.com
36 camo.githubusercontent.com
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

83 whatismyipaddress.com
84 whatismyipaddress.com
82 whatismyipaddress.com

pid	process
5292	Eras.v7.exe
5476	Eras.v7.exe

pid	process
5476	Eras.v7.exe
5476	Eras.v7.exe
5476	Eras.v7.exe
5476	Eras.v7.exe
5476	Eras.v7.exe
5476	Eras.v7.exe

description	ioc
Destination IP	191.101.209.39
Destination IP	191.101.209.39
Destination IP	191.101.209.39

flow	ioc
34	camo.githubusercontent.com
35	camo.githubusercontent.com
36	camo.githubusercontent.com

flow	ioc
83	whatismyipaddress.com
84	whatismyipaddress.com
82	whatismyipaddress.com

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 879719.crdownload	pyinstaller

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{31B018E4-1F47-46D8-98C9-DBD98BDF40D5}	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 879719.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 879719.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	process
4476	msedge.exe
4476	msedge.exe
2820	msedge.exe
2820	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
5168	msedge.exe
5168	msedge.exe
5604	msedge.exe
5604	msedge.exe
23400	msedge.exe
23400	msedge.exe
23400	msedge.exe
23400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

Processes:

msedge.exe

pid	process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe

pid	process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2820 wrote to memory of 1344	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1344	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3284	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4476	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4476	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 1796	2820	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Noisec/Eras?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfb7846f8,0x7ffcfb784708,0x7ffcfb784718
2⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
2⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
2⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:112

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
2⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5480 /prefetch:8
2⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 /prefetch:8
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5168

C:\Users\Admin\Downloads\Eras.v7.exe
"C:\Users\Admin\Downloads\Eras.v7.exe"
2⤵
- Executes dropped EXE
PID:5292

C:\Users\Admin\Downloads\Eras.v7.exe
"C:\Users\Admin\Downloads\Eras.v7.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c title Ẹras v7
4⤵
PID:5552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color b
4⤵
PID:5568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
2⤵
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
2⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
2⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
2⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
2⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
2⤵
PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
2⤵
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
2⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
2⤵
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7120 /prefetch:8
2⤵
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7140 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
2⤵
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
2⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
2⤵
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
2⤵
PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:1
2⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1
2⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
2⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8184 /prefetch:1
2⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8496 /prefetch:1
2⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8628 /prefetch:1
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
2⤵
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8632 /prefetch:1
2⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1
2⤵
PID:6344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9496 /prefetch:1
2⤵
PID:6416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:6680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9982945801589718988,4142068706811412617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=9528 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:23400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x150
1⤵
PID:6896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\837da011-c50b-49f8-b992-46f0d8df269e.tmp
Filesize
13KB

MD5
050a4d3e2ac5460681509986cbc2328f

SHA1
d3e4eb46ebd8920d6f2c7722cd6cad2027ba16df

SHA256
032a3ba35ab55d0c2f6f856fcb108765be60dacfe0e6e69d822e2ed455be4634

SHA512
19d07cc2680bd90e7c9036359530d4bce0ca8620757cd6254ef2a5126250f4397dfe9d202e485a19ca515409de22454f4e7a09587b434900c0af0da7eaf0a85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Filesize
40KB

MD5
3c2ac6ed09323fe172784cdec7f3d671

SHA1
79eb656ac99f1a2efa7fbf8e8923f84dd2b63355

SHA256
67d42a456baa3edbec1eb21c94f294c04a72bac350acfae80f4f2b65afe8bc5f

SHA512
ac95a571afa882744a42447e84c1ca5231303ba33700f63e99d58860e9635ddc861745678d5c74b137af3d50daf05ea710abe65b11ffba95e2b2f6aaafb65071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
1.2MB

MD5
1f7c0a3a257e5f561b61cb6af85289a3

SHA1
7bfd5ea039ee0f291fa4e5ef23ad91d583e840d5

SHA256
d15d37dd6e8b273c4bc1e4d64b8d462f33af2fd58831ea3e28c1cb6fcdec8669

SHA512
64a0eaa739a6f7f6e5579975a1dacb1741fe8d2f106c08df6cc87fde0bdad59ee80dbc8f7ea38cc926b5a51e469e32cb11effc0cb1ef50475fbc7747d240a442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049
Filesize
32KB

MD5
7ed17a85b04bfa64cb2d278714d82283

SHA1
e64e26d690e461a0b5ff551f8ee30e11bc4dc165

SHA256
56981a3315fa9ed3d5e8c80472110514725528583a50a72798853af74a1c8fdc

SHA512
df59b5f797a23effcfbefdda8ddadd461a58b6a9e6aa21d0a3aa8d81df18c4d2b9d90dc2206271f2ff357c19fdf3c85bf15ae27f412b794174b0496f3343fa42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f
Filesize
64KB

MD5
d84862513956cbe61aeb4ebbfdd3355a

SHA1
14ab269df17cb0333b1556ce120d587324479f6b

SHA256
a18b26912ab9e034923cc64fbfdb59d682500f2c556456930e480b6bd69e33b5

SHA512
d04ca96d72595f1e291a6ce96f092c1707064800103cde733512a186c1b22e089b63690a0c53965c97248dd782731b22fa2d27b8ee3ae112647382f1c06d1a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
b50897d930272c1c08773e639580e9a2

SHA1
40b603d6aac17666b75f694277a5bd47b0aae79d

SHA256
0985270ffeabddcb91398425483836c48f3b084ed60bd16c3cc94ee9f3057718

SHA512
812e655391f9a0d5574cbfb753ff8bdeea7560d941718f7f1e0271aa00e834e4420f541d8c780f9823e26569c13337abf0f4ec62ef53124cd3ebf3689d4ffb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
a3e8a47dbf2f3c16f7c664cb6edc364b

SHA1
7be0ab09072f26daba95bd462ff7b37c030f6649

SHA256
7844fcb31a350ea71f683dbfbd4875c23e6d0b4ac2e7b8139da677f4ca3928a8

SHA512
3510fd3438be5a7ae9e5f3cc0c020f8577cc0169af333681fbd9b86cc57c8b912282bb38e2e05043fcff130a8a90ad33dd671e909ecd95f1f8a1a16a474026e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
fd37f81543108e4b27a7d66ff1b6ddcd

SHA1
ce09a6959edfb526e5470c07b4081696fb2401fe

SHA256
f09725bf34ec61a8adace714c2e855165de597bceddfdb59aa302db05f958ccc

SHA512
45bf5550304b93be21dbf0259f693c17668c8335e6c3aa6745a7ebe07691d3f7837ec88be47f2a968dee2add0f2e5dd664d6c8ef31a0fcbdf1abe2653d97234b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
14KB

MD5
becb28232e76021fe82b496f77c9348a

SHA1
483c9aa2e959d7d146baba04553ed5b4e4ff7e8f

SHA256
7ede689f4d0c3d091a758ece54b97e4510a3addc1b2a7d09aca153c232419fb9

SHA512
d918e0bd1956db342e8e6f289b371230655a6e63878271af3368488841f362d9dfdeea1a5a33f4aa6cccc8543951ff77c4e75d5a3c1f2a61e206dec1eb9a172c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
11cd27b0a4dfa75b968e3fa0ed851081

SHA1
6a008c4b3585617b0ad5bee4a31533451f5d6dcf

SHA256
aab90316b35a9c903f3184fe98419d5f1d509094b59cb437ffe9750599fc764e

SHA512
7b3e6a7c25c59079c544f7d634dac11b35f862189c8c26669de4ea05c5013687684c581126752d33d8304eccb817ef4251375216e535ab131a0eecaf70c385c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
557f2b36e4b1b20d4951784073706475

SHA1
a0fac60ecb8131d1242ba19f1a19313408ac9374

SHA256
9930d665210f6950d1be81bc8d9ac129568e2a432d54034b9e28af5d8b8820c6

SHA512
301cb7a131fa6347319f8e85006d1b49f8187e64f24f19ea32bc2dd7ab6caca4cd7aba472caae5d343694983d185e14391912fc6d6a2aa47443be8a591fde3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f3097b9a7f9f9c8018e72e6fc2d11431

SHA1
ee149b7fc7a9101e40e519f98d5d55f6350a61c7

SHA256
f69c2f46da77ef5194b0afc02e49f949af425f3ff7d38aaf5a8a25862d6f5957

SHA512
330c44b296e68fa848690be19b767bf00723f0d5d1de93c560214c42afc40514d2588426350c49105e30b64668758ed52b7635c2463acb6848cb4af510c99180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2a36505fc00a55e86881e5972d2ce85b

SHA1
b91b5278ee7b8f54b07ec030d9bd2e94eae34cb9

SHA256
4b6268a284a75389ff8e8a71e9504075b857ac1fae350a0242f9129a52af0ff4

SHA512
e406356a2a377ce8239c5e77483d688f17113207dd8e611bc3af2f08e3f5667dd85380363e850d3158671c4ec5a0a9c5ebd49aa9e4153802aa378697c784d449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
ec6e4aa6ba60853c695494c3b1a2657a

SHA1
e20cd67be5e08706a0e6d55746d0f065de06b8f9

SHA256
3664bd2f2fce6ed5a08b508eb2dc1f27b7baccf617d1bdb51d9481b859186cb7

SHA512
d244c85c4b9cda2050eedd40616797a57ba1458b3ceb3971be4848d54fabc78c698e1a8351cea2fadf98f5a6f5c061aa3ed5600ae6cadbfe21d737c3fb488b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
53119aa75b34c53190493e0f7e4c9e10

SHA1
4bf7dedea32cf24979ca61a6dd558458312ccb62

SHA256
eef02227cb8fc14ad3c3f5a409cd5128affe9b5e5f588b82b96d86ca2dfb6947

SHA512
e45a92bbfa03a705974cd2aae34ce8c9630134908e44cd617ecd69aea495f488d43aa15656c6d49e0009bbf71da5d6072270cca8902f9e5074205041989dd4cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
d7592a702edd05f458c9cbe0391fef0f

SHA1
9ffbcafb2f23bf24b426ae8360e777dd945c0106

SHA256
b4d78ded7112418cb5a319a48754b76444d090688addc53159b28be71c321b31

SHA512
e6d0f8131d2ebfd56b52d204a1375eb82fc4983da5468eb4030ee8174771eb17d2bd694e416986d3dae709001ddd53337eabace4418ccca5afad8483e5194427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
aef08a9ba51473864299b510317a4629

SHA1
8f0ce1cb083d9f6a6a64c6932223477b7511250c

SHA256
1dc9c7c3e7054a409e38b4acdf158679f60038e6e87abdc89991000a413c1e36

SHA512
612a19620d7f09a602acf37c002d7276b4c4068925ca38d728747430613a14790b2a5bd879cb927b1466c674e6798dc7155d05be753e35938e41a63d2b0a9f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b8f0.TMP
Filesize
1KB

MD5
d0b0b9ce5caeebb7a4efac00453c14c0

SHA1
0fb03dee81dc33faf1aa6379fde4f9be7c5654a6

SHA256
8acc3337bd66866ad796637aa11edcd631b981e86097e300a39b50577f23803b

SHA512
64335b4c74829425635686158cc397eabf46c9feb206ac5108aac0dacf9168497bc3000dc1374f5d9608ac3cf8e4a2faa139d54da9cc3157ed7980e76ad8c0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b76c91cc33662ac547b39ba9843473ae

SHA1
4ae5f9269a2df87960334e43d36f098f8a2a92b6

SHA256
d6618da07bcbbbeac459c97912cbb978a8306cd69876d8f23c3c7581f598a31f

SHA512
2edf3d467d36f27cadc027862978be234a4b4d4cb52faa38a0d5ca6b48f91bd8f8666e127727249abbad3e7551fbbfa63576e8487bf59adb7632a585b8dddf2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
c022e71e94decf416a5154b1c20f1483

SHA1
a5e593fa3c17541a50ae850bf10880a8d1b54fe0

SHA256
5c4ed0054e31d2e866a59c5d26801d5c7e020c85580c75064695180aeee2f2f6

SHA512
96e7c45e71126c325fb1278a6ad743f91fb0c65d76673faa1635a804a28d68fb5163a92521260efefd2e25f265a2996f4edc3f3857309b86429f5443262d2768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d2cda491fc929fc5a678d32fc1de9eb8

SHA1
d8d93c793359bf3821f2ad85e26780887b4ae521

SHA256
41c42a231ab91114d1ad2042fe5c2124964f55c8ad48b1f35f48a63d38769d25

SHA512
970c135a7190b907756e58dbaf8aa602375b95cb34acff1c2bd71e9c9cd956e1c26f3b431b955d3c96dadc35e484983fbaf120115c391c5c118398c24608f126

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52922\VCRUNTIME140.dll
Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52922\_ctypes.pyd
Filesize
120KB

MD5
6a9ca97c039d9bbb7abf40b53c851198

SHA1
01bcbd134a76ccd4f3badb5f4056abedcff60734

SHA256
e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

SHA512
dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52922\_socket.pyd
Filesize
76KB

MD5
8140bdc5803a4893509f0e39b67158ce

SHA1
653cc1c82ba6240b0186623724aec3287e9bc232

SHA256
39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769

SHA512
d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52922\base_library.zip
Filesize
1.7MB

MD5
3ea69d78a7aa9244c2eae0eec291d457

SHA1
11d09841b5db27ddce72a3a8a5c075d115c717e1

SHA256
0a82a8a51040809dee10af0084d9f0d500195204aeeca1843e6e6249c77c1db3

SHA512
926ef6a32acae0722ac2b9cc0f3c0c1996a64f1ea3797d5d60f76992f128a584623943f3daa445d8ed948987772e1af39de5d278903d637660298a27bef3b69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52922\libffi-8.dll
Filesize
34KB

MD5
32d36d2b0719db2b739af803c5e1c2f5

SHA1
023c4f1159a2a05420f68daf939b9ac2b04ab082

SHA256
128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

SHA512
a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52922\python311.dll
Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52922\select.pyd
Filesize
28KB

MD5
97ee623f1217a7b4b7de5769b7b665d6

SHA1
95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0

SHA256
0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790

SHA512
20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 879719.crdownload
Filesize
6.8MB

MD5
5e1683c1270ac5833f4c28eb2f394b7e

SHA1
934a369fbf7d1a7659c448000bea8e7cef8844e9

SHA256
632787d120742d9b7c9428408d51fb62500286b2eea431f28d34c7d4c11baa47

SHA512
7a65a56899a2cbf4a876f0b93cf7e9c54a03c0b2b7c12314f3fcf0d5ff6bdecaed972b26ab13016f1ef175d3a7e58458e2a94a2f26605dffc1f9b4763dd4f449

Download Submit
\??\pipe\LOCAL\crashpad_2820_IVSHDTVRPPDHVNMG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit