hxxp://f5ea9bc2a7b9c2deeed4f977fcc83720422cc01c6c5e628c214c147e02e7f13b

Analysis

max time kernel
1040s
max time network
1036s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
13/06/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://f5ea9bc2a7b9c2deeed4f977fcc83720422cc01c6c5e628c214c147e02e7f13b
Sample240613-dkk2basclh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-952492217-3293592999-1071733403-1000\{C5B923C6-0FBC-4533-B91A-1AE1E29B4393}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
2488	msedge.exe
2488	msedge.exe
1876	identity_helper.exe
1876	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2372	2488	msedge.exe	79
PID 2488 wrote to memory of 2372	2488	msedge.exe	79
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3336	2488	msedge.exe	80
PID 2488 wrote to memory of 3216	2488	msedge.exe	81
PID 2488 wrote to memory of 3216	2488	msedge.exe	81
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82
PID 2488 wrote to memory of 1928	2488	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://f5ea9bc2a7b9c2deeed4f977fcc83720422cc01c6c5e628c214c147e02e7f13b
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffc6ba3cb8,0x7fffc6ba3cc8,0x7fffc6ba3cd8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,7920807598676331915,9941944566795379659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
  2⤵
  PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004D8
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dca6901942fa748fc01339192c0738a06847d8497c9c61298f1e5df1f8352fb0
MD5 2dfecbb576ee9795c5284da8a2a3c7f5
SHA1 f1f0a6a97850aca2b4ab267a017564af02f24948
SHA512 d664cc261113427810dd0b2d32763ddd08611a528fe6b285782d6b8ac03304b72a90fe7f3f7142e825ab8d948d5c9cf52f420546f3796b2ac23f3d00f3c17389
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9a98b4686c9e90672a548c873943b3027fb111f7992263111d912318429f5834
MD5 6486ee9e961a437dadb68ff1544d18a8
SHA1 05f4daccca0bc1ce73fe71ad2325ba5dadd3df25
SHA512 ee3659f68a46f37f340f98b85a7aa289e700c5ced2a4f0104673bb5f18cc82d1e9b838ec0278407213c6ed2073998e7aad78a7a39390b7e460c8e26dfa91d0e9
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 67KB
SHA256 3bc12ceb802ad6eddaa5ed768f42f33ec31626bd424f219b58713a4036b126b0
MD5 bcf2d8d7778e1ebc837c3b75915335bc
SHA1 c7a1186fbbb39ac1a04b9cf64dba641cdd24c9d3
SHA512 4a9385156e524761a081780faccb8c6a4dbe0e0289c6707cedc07868ec167c82e4d06b199361186d508a4e8076a13e773b443868bbca116c7c0456d60e880ff9
SSDEEP 1536:XZlmxSArJeQUzFPM2qAwhnex8tpKSiiuwq4bDzj+vWMw:vmhVLUJFwhnex8rlb+OMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 41KB
SHA256 61a605bcaee63256c8bacac2d0a6c27deb9f9e38b581a54da4589744fc07dc52
MD5 b07fe559839d5ab1920a795bf8c5b074
SHA1 4e72cbb0858af473d7cf380cc4a704a8db52ffc8
SHA512 9331c10406ca27479657da7ac3fa16850e5002d9c45618f49bfb0108ce35abf3ddd157faee4cc52397dfd27184b9ea07918b727b6feb9be326396d18e5308cca
SSDEEP 768:2GcbpGkJqtZPXduVlgS+6DHt7u2t4xetC5I5IN3u0qFeTA8ODNc3:2GcbMk+PfmNh4xeiI5Cu0Po+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 1.2MB
SHA256 91c7483f7086c4019bee8005e6e32b15eea1d4c4e596c13bfbfb616d0f4f6a42
MD5 76e2533d5c0f986355fe79efb4f5e4c3
SHA1 1f26c931a1b019c96159c055b72e400ffd34cb2f
SHA512 07f9f9ad2bc1ad100135494c6d3662d3e169df0d949ecff246298b1e5b6f9ffa87c75cfba323f9d6d7ad0317dc19f95da6dc22df16cca3130f035dfb2145e764
SSDEEP 24576:IDhqPCGZ5rszE2xQL3A6oPGmCqfT4nzBsfjDtByvijB4RImEKcHMKZLjutPZFOl8:IDh2CG/2xQL3W+mb4nF4jDtg6SXDGMKY
MD5 SHA1 SHA512 SSDEEP

Submit Download

43604d2a195c1916_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\43604d2a195c1916_0
Size 2KB
SHA256 4ecac9a77cdeecafab42f407fbb356a5f13b3fe800ce3bede9474f2947838ae6
MD5 f7c4fbc6eb3c26b294b2bf10b528caf8
SHA1 8b9279f4366ff2cd2937a3c31461080b8d6b10ef
SHA512 55603307141820e5b2a3f4dea874d984d64b4a6661e41bee02f7a0629401861dd296e2e0a1c6251a4df3087ce337a39369d85166cf3f518e1146baf54adf174f
MD5 SHA1 SHA512

Submit Download

45a16ff6d0d9ab5f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0
Size 1KB
SHA256 935c0ac6bd7c009798dc5e5c042265315318797d553c8e3a9fe97361cf6693e6
MD5 13dc06e1f980524ec39b088bb6f9c7c7
SHA1 eb6f5c2a0daff77d951e0dd7674ec9c412848f5d
SHA512 cf252021305bb8455625ded4e94ce9ff88de69f5730472fbdd6200576a6a375280046b083f4049ab602081d7d5c85d2c96d6d927d4b07ac47426daa3f9695887
MD5 SHA1 SHA512

Submit Download

67391d7ea53efdc3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67391d7ea53efdc3_0
Size 5KB
SHA256 31288bb4061ebc55b54b90ad851e709eb6df205a6738a5a3ae29139db55a128a
MD5 82232cc7763296df3538974bb8988450
SHA1 c456a8cbc031dbf7ad04eb8503f6051563d43bc8
SHA512 4ea644af8bc156be21bc3e73785b66bca79121dfcfefe457a93ff0a86ba792a9ebd3cf49e3d403b8f8b18e8f075b17f59c0812489e8b6670959d8fee402e2787
SSDEEP 96:96ZzobTFJFDZ/LMBwJG7ljnY5mbDhYKh1vsulWZuFtW:96ZzKhZ/L+wJG1EgdxjMZuFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

71da22abe269277d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71da22abe269277d_0
Size 4KB
SHA256 9a129d30fd06a617616aea10940d98d1b531add5120b9c7d85d0fb780b43daee
MD5 258b4e5e4176376de2f98402dfffeafa
SHA1 dc3ef86552330c22de8f45bac3cbe98a17df8ae3
SHA512 d45773a03c65eefecc0bda667882adcad239141ed95f72d15e74ab2a5df551adf43d2e2249e197872b814621f6de45c13a9a089cf6c3d445ec8c731b2bd7b839
SSDEEP 96:kbRBiDf9ea4pvv7exmqsokYY+O9uQYlvybx:kzihea4pvv7eSV0nJyl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7d11df596af7121d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7d11df596af7121d_0
Size 3KB
SHA256 c08f47afaf55d4cd8c8d82a77ce2a91afa4b025391b3f8a3386d23131c972d14
MD5 df600e0cd0a238897fbc5afd31a81d2c
SHA1 9c7bfe32c1a82256fb69a1b4b2f542ac95622df5
SHA512 67a8e2773324e48faede9448b71b0384f0e02f06df53eb5a3b8e8a1354bd40c196165a3c607d57f19b72a9aeadd1aeda4e9f7640dec31d853cfa778b8f64d14c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2051fdd777fcd888d3317c703272877ab932e5fba1e6d92b2e97a764ce5e22a3
MD5 4405478956599b04d98aba89f06873d7
SHA1 0252878da11973a27e7c6d3d7f6386bfeb5a3a1d
SHA512 189f933112d3b8bac6b8673f56a1e61f56a2dcc77485b7f160700ce6f01a67d8ca11096dc64430057d43b9a61777f60c9f8882bb7a6ed6251ba43597af438b53
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a36ac556389fe4b14fbcc6f687f2dbfa90c9377b253b6c2ce1a98ddaae0408e1
MD5 8ee9a7f03be5c27326775bf9fa8919a6
SHA1 ae5f8f20e98973b9ec37db33b5b7b36a58c0af6f
SHA512 40541297341866e571848e54655ca05090776491012c7593ec3b504e11af465ecd4b5de1df1242de6e380c7bcf98095fe60d9050c6a97035f07c84030471f298
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 22c159f2b2cfe704c6811be5e2bbaf878b8683e387f869df6e344bf66137b94f
MD5 4a5419f9e1812523ce5dffed13bfdead
SHA1 185ddcd03f6c641e6b5a9ff89e805363ae743706
SHA512 bfc1b4e63e80f1b39e441bb902d15bdf274ea718a997b404e768a6c28f52b9eb830fa37ad0f74aacbcdec0ba45c1120f5d5bd5fef9cccbe49faf99561ea11488
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ec5a66aef345ba1e8d1a380734926912f0aab2ae838af77a55cd6b4213929942
MD5 9eb497bd17a5db97258850947a530e31
SHA1 3f6d0ff79999758c52f6fbc22ba734bdb4167234
SHA512 6bfb3bf89ecd3d89306726fcf33c6e812b744ccd70e92a758466af30bf47d6a1fd0f357e877f056bd0a8ebdb12fcf6605dba7046959a4b0d41da75773d12d491
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9fe0affde9624f55becacf09b59a8847059184281e34243f85a43accee835e62
MD5 f6379993f6c809c073bc72712e671a7f
SHA1 1a5ecd84da86a405da61020c0154544c57b06417
SHA512 a7a2ba26a03f745323253b49c0b151f6ed8a14a5cdb05951cf481f6c5c4e539bed36c1de213e77c39b79f84616f5d50004f4e9728d172555ac1fba86cb1776cf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 921B
SHA256 1e30f33f7f7d4490e2229e05329999535b114a17f91ed90f80c158889c316526
MD5 ae48a837b84a31010de33db0bdc08f69
SHA1 7e2948b399754757b62014d0f1465edb8d9465c2
SHA512 90aac2ecfba157c6e01d309ffcd24da060bb789b11c76bcdab350f7316f4351496a7e19751d928046ad85c4a75700cbbf165090ead0f123c766bbc778c5d36af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 921B
SHA256 c47d84e7411f1cc4bc31f807eeb12eae1b7b712ecf7d160502d5bcfea6e1c6b8
MD5 a41521f2b3d8312d4025261ea638dcb8
SHA1 a110334a1d20e7073d8b3bd2bc2f147702ecd0f8
SHA512 0beb459ea509de254f316d31392c3e4a347820d8bc91c2ad02aa72ad926acfdca351cdc0ece90bcdb6a09e8b061005448724c152ce2910f5f291f1faa20ef09c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 921B
SHA256 c1b7059d6c7f252518dc188cdd68c61f9b52c062392fefbaf00903891b2166b9
MD5 93f7b57ecf8459640830911fcaf3fcc7
SHA1 3a24aa3e8f50442430bafd1df7068ce335f3da73
SHA512 0333e5e254e8d27fd3288afcaeee00ac337e293b7685e1b5434b84e22ad7600cba986983ffb7d784daf2cb3f657b0ccf1a1aca16d25ce9c5ecc384ebd193f1eb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 921B
SHA256 09912d9705507a4792a44056a43cfc620ad456b1cd35936d4d38a0ee7d4de66a
MD5 773f7f99e5f350baacfe51ce8b5f60cc
SHA1 df63c23782aafe0a4bb8ad2d902e2a3dd3303add
SHA512 538dc64b546b27857be2c18ec1fa16af5489a503ea4ea8e09280b860eb199061856c4fa7bcbb496d99739994b930a15ae0f0062a24c2177f3cd6590fbff4a692
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 921B
SHA256 253768058a0d9ba248d1ed8bdd1ba18429366dd1fcf9364abec84ff1431538b3
MD5 c4d07e3a43e370a3112b1a15871fe285
SHA1 806823edd0b334ee950adcc935050b3101afdafa
SHA512 6f2424bcdb77a9819a98da70a784640f25f5f4495487df9f5681929d950cd17a87e37db651ea2a398921c11212a7c02fdb50ef7f4465dd3004aac589088f3856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 921B
SHA256 00a28cd40f3c085ef9a15ef9cea499a5a5c96ee6d5e8b1123094ebe591dfbae4
MD5 40506efc9edd98666d26c16864036ef7
SHA1 afaaca3af2e3e1696075f3d8063147271b201f53
SHA512 1f8c6aabb73ce687cb56b2a353da0325d35cd45f6b8d6cfe5e0e12b9fd1f16fde661fa57bc26e9e69c9dc10a30c59068c8ea7599afbb06fbfacd762540abb9a5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 921B
SHA256 37c302d85dfe847d7f3e3a5bf84df25f8d3db6f7179faab33fa942a514b855db
MD5 99430fba053b16e4163ffb4782487d35
SHA1 2ef7e3d0e9f17604338d9010b578990c586ab078
SHA512 dc632aa7ab1489c233414bee455ec9eefd9ae46d00b308a0a045d7bfbff09a26d3a8c8f2d231963627019e675c09fbcd2948dbfb91cf1a3743fbeb7f4964df83
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1d8aaeb8359c6e6c9e6e1780a21d37d791e48abaeb5807c1e037db97835c7b95
MD5 704aaf20bd9019679f2af523b16ece5b
SHA1 219504fe8ca6115045ec179014eeda7569604882
SHA512 9c2b5501018998b1c6860928f28542504495ab9c72c557de2325498acad5bea87222dae434ccf1237c9539d27e53b3529d2f403a531876b07ec0139bbb1832f4
SSDEEP 96:n6mk3rxm/DQYmtN3ket0wSv0MoiVmdHIwJu0WQyV+VuziX3wI3:n6mk3oI73ket0v0MAIGuLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0877c017e607e906bd11bbe3b2f5f18bf3f40e9e160889a5fb03a5f3d5ef19a4
MD5 8db923e387d45c8fe162f2fe25f25b4d
SHA1 719758daa29acc2bf13910963dfcd5980a3acfd7
SHA512 cdcfe18789ad2fe647c9eba40aa874873772ecae37e478430f4d2121e60e14b6b50fa52514185c9ed020e72ef2a1484c8ae832c9313fb157d23f5c6e8dd0706c
SSDEEP 96:n6mk3rxm/D9mtN3kOt0wS6I0MoiVmdEuW1jIy5jJu0WQyV+VpAiX3wI3:n6mk3oc73kOt06I0MRuWhIWtuLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 45b3ec200a6540553fb9c0dad2ab7881c2849520aca87e1f33ceeac9595dc747
MD5 9a0ee04dda5b894acf57f97b734cbd96
SHA1 6e41648bd12a413f0e43810ec11b991c4fc67c27
SHA512 03d6c066e3df77ac2196fa9a3b91eb47870ae82c6033d12d8276f1ae4c0658cb43aefca96d1d153caa8e4a03d68308f26b47caad1bb500f526248f3fabebf4d9
SSDEEP 96:n6mk3rxm/DbmtN3kwt0wSnN0MoiVmdEuW1jIy5jJu0WQyV+VpAiX3wI3:n6mk3ou73kwt0nN0MRuWhIWtuLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0a000f9202cb4d2c86bc3693adf1dd29e65bb9089b48fed73fca765d78f7922e
MD5 42b6a2394a67f322d8147d2f59d1c82d
SHA1 ee7f79ebab1eec382919d46b872d56c24c628a9b
SHA512 28d8a42e6408cff96ac19df16300e6b8736de034bb0c03447ea0f8f690c9363f99495134d8c9543bc8c6771c37734bd968f5c43c42a6aa58d3d7fa613a6e76b1
SSDEEP 96:n6mk3rxm/DbmtN3kpt0wSteM0MoiVmd5wWjNIX5jJu0WQyV+VpAiX3wI3:n6mk3ou73kpt0teM0MowWpIJtuLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5d0066bd2733b873926991d2cd251d26dfc776337cd6dc5d1b8d12013d890e31
MD5 d1c7ee4c185286c19f91110c0735e948
SHA1 471724a522315746afdd7049c3c54bfb35b8d52f
SHA512 a0112866d9a2f8791e14990facde6f2b5fb3d4c22434775fd060970da8c1bd7f92e7491c51fb9992bebf76ea1aada5fb8db774293d568e9ff0db6eeb4fc1e165
SSDEEP 96:n6mk3rxm/DnmtN3ket0wSv0MoiVmdHIwJu0WQyV+VpAiX3wI3:n6mk3o673ket0v0MAIGuLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ba60ebec37ee3593f48b806dc49c39c7ce15aa116b57a4c96791533a8e5e5e11
MD5 b950252db929bca5d802c61823891c39
SHA1 23bfdc571befaffe11b30834b0ef7aa483103d6c
SHA512 ec4d0555a9be93c54b9517ac702987eaa922bd438cd4b308badcba166c485f3bd2560d708da4e0673b3a42c66063a82cdbce1b38db0662cbe87708d8695926ac
SSDEEP 96:n6mk3/xm/DbmtN3kpt0wSteM0MoiJrR5mdHgb2yfleh5jJu0WQyV+VpAiX3wI3:n6mk30u73kpt0teM0Mpggbz9e/tuLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 98b785234914c9f767584ecee88f129aa5a47e393faa6a38e9522a2eda6fa120
MD5 ecfcc85fb66b767cc0cdeaa9919fa2c9
SHA1 a3faa602aeabe1e199c86ad389e1d8c9fa8bc364
SHA512 6ab7e280e4de0b67e5e2fb1e39a64d260e14f7be26e66d295ac116641aeb6e0716437f1567822369f37f5d3c20b8dcfe171e9e18bc881bd1a3d9e9c7d6eac46f
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG1watUe2RUxBR6oC7YvmljEW1:M9iIxuERzA83h09RZxASG1wt0WoC7Ykv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 530d9e83c02d6c6446c497d79f146eb33c86dd7e20a0fc82eab11698d632dfef
MD5 51978a0b535b8fa5c059689b9a8559f8
SHA1 07dbe89b9cd1be0a6d27a9233e57cb472d5dd8e9
SHA512 8167e5b7450fb2cbe8e144cf8a4170b64096236a0dbf03ff85986d6e2c403f346a18eefa91f0df486e9b20ecd7421ebd9b42a7de6ee55b2c666b805f3c17c731
SSDEEP 96:DIJexKCwJ7IJ2zbuczEIJBMwIkDlIJ3uHkIJnIul:cmFybDXmfNgBIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 49e6ebfcaabc455139c70394bcec51524772a274254e631a4924e370d55cdd40
MD5 e7a4b615b7fc0e82a9e34913eee6fc18
SHA1 b83d1cef4375a94222d5b6efa59638bb8d3728ff
SHA512 95a746af32283854a7175a9ce02e34e784f6cbe213ecbdcbd31670c93f42299a89543711bdc63f61b58c411327d4fbed02eadf73011291eff883c3bfe648d282
SSDEEP 96:KIJqufkwNf3IJexKCwJ7IJ2zbuczplIJ3uHkIJnIul:RYmFybDQNgBIw
MD5 SHA1 SHA512 SSDEEP

Submit Download