hxxps://outlook[.]office365[.]com/Encryption/retrieve[.]ashx?recipientemailaddress=jdevendorf%40barclaydamon[.]com&senderemailaddress=OOC%40citizensbank[.]com&senderorganization=AwGNAAAAAokAAAADAQAAAIM%2fny11uodEofCjAPo39WxPVT1jaXRpemVuc2ZpbmFuY2lhbGdyb3VwLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIwMUEwMTAsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTfZ%2bNib787FKieqjHIyXNL9DTj1Db25maWd1cmF0aW9uLENOPWNpdGl6ZW5zZmluYW5jaWFsZ3JvdXAub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjAxQTAxMCxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cMN0PR01MB770738554A970FFAE0DED721F4C12%40MN0PR01MB7707[.]prod[.]exchangelabs[.]com%3e&cfmRecipient=SystemMailbox%7b67f0a663-4dc7-4c86-9784-bff2dfdd2bd5%7d%40citizensfinancialgroup[.]onmicrosoft[.]com&consumerEncryption=false&senderorgid=c9797bcf-8071-4c75-9ff0-5e2c6d7f5d4d&customizationTemplate=CustomOME&expiryDate=133679649229383627&urldecoded=1&e4e_sdata=c42sPYF01%2b5eka2W%2b0y%2bRc%2b6z4VUkGgH1LBlnz4M5%2fJV74yCCDeRHsyATWK2%2frawJz8Ulle8AveslvQDS4tdyPdrf%2bWpL1uKJAEBkfHX77O47HdQg2t5RzSBdFlbKt7D8PkGLn8TbBo%2f0WG994f46L6m0PKU1enl2NUd1JCYPRrOFtrZwp9m%2fWkwG%2feoya6XYgdpm4Rw1VnbSzmHeJqmSfuH21T5AhQCNVdbCtRFEiDp2Of7rZzW6SAur2WpAWdljm5jHgWDavc8oSVTxHfnG2LF3UTKk%2fl6G5TyrBVmyroQpcCFBPEK4xMwnUlbqb6GaP7IaYOEhQFmzgTFAaJIkQ%3d%3d

Analysis

max time kernel
107s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=jdevendorf%40barclaydamon.com&senderemailaddress=OOC%40citizensbank.com&senderorganization=AwGNAAAAAokAAAADAQAAAIM%2fny11uodEofCjAPo39WxPVT1jaXRpemVuc2ZpbmFuY2lhbGdyb3VwLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIwMUEwMTAsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTfZ%2bNib787FKieqjHIyXNL9DTj1Db25maWd1cmF0aW9uLENOPWNpdGl6ZW5zZmluYW5jaWFsZ3JvdXAub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjAxQTAxMCxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cMN0PR01MB770738554A970FFAE0DED721F4C12%40MN0PR01MB7707.prod.exchangelabs.com%3e&cfmRecipient=SystemMailbox%7b67f0a663-4dc7-4c86-9784-bff2dfdd2bd5%7d%40citizensfinancialgroup.onmicrosoft.com&consumerEncryption=false&senderorgid=c9797bcf-8071-4c75-9ff0-5e2c6d7f5d4d&customizationTemplate=CustomOME&expiryDate=133679649229383627&urldecoded=1&e4e_sdata=c42sPYF01%2b5eka2W%2b0y%2bRc%2b6z4VUkGgH1LBlnz4M5%2fJV74yCCDeRHsyATWK2%2frawJz8Ulle8AveslvQDS4tdyPdrf%2bWpL1uKJAEBkfHX77O47HdQg2t5RzSBdFlbKt7D8PkGLn8TbBo%2f0WG994f46L6m0PKU1enl2NUd1JCYPRrOFtrZwp9m%2fWkwG%2feoya6XYgdpm4Rw1VnbSzmHeJqmSfuH21T5AhQCNVdbCtRFEiDp2Of7rZzW6SAur2WpAWdljm5jHgWDavc8oSVTxHfnG2LF3UTKk%2fl6G5TyrBVmyroQpcCFBPEK4xMwnUlbqb6GaP7IaYOEhQFmzgTFAaJIkQ%3d%3d
Sample240614-pbt4eazfjd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
4732	msedge.exe
4732	msedge.exe
928	identity_helper.exe
928	identity_helper.exe
4932	msedge.exe
4932	msedge.exe
1384	msedge.exe
1384	msedge.exe
1788	identity_helper.exe
1788	identity_helper.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5060	4732	msedge.exe	81
PID 4732 wrote to memory of 5060	4732	msedge.exe	81
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 4136	4732	msedge.exe	82
PID 4732 wrote to memory of 2208	4732	msedge.exe	83
PID 4732 wrote to memory of 2208	4732	msedge.exe	83
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84
PID 4732 wrote to memory of 2324	4732	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=jdevendorf%40barclaydamon.com&senderemailaddress=OOC%40citizensbank.com&senderorganization=AwGNAAAAAokAAAADAQAAAIM%2fny11uodEofCjAPo39WxPVT1jaXRpemVuc2ZpbmFuY2lhbGdyb3VwLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIwMUEwMTAsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTfZ%2bNib787FKieqjHIyXNL9DTj1Db25maWd1cmF0aW9uLENOPWNpdGl6ZW5zZmluYW5jaWFsZ3JvdXAub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjAxQTAxMCxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cMN0PR01MB770738554A970FFAE0DED721F4C12%40MN0PR01MB7707.prod.exchangelabs.com%3e&cfmRecipient=SystemMailbox%7b67f0a663-4dc7-4c86-9784-bff2dfdd2bd5%7d%40citizensfinancialgroup.onmicrosoft.com&consumerEncryption=false&senderorgid=c9797bcf-8071-4c75-9ff0-5e2c6d7f5d4d&customizationTemplate=CustomOME&expiryDate=133679649229383627&urldecoded=1&e4e_sdata=c42sPYF01%2b5eka2W%2b0y%2bRc%2b6z4VUkGgH1LBlnz4M5%2fJV74yCCDeRHsyATWK2%2frawJz8Ulle8AveslvQDS4tdyPdrf%2bWpL1uKJAEBkfHX77O47HdQg2t5RzSBdFlbKt7D8PkGLn8TbBo%2f0WG994f46L6m0PKU1enl2NUd1JCYPRrOFtrZwp9m%2fWkwG%2feoya6XYgdpm4Rw1VnbSzmHeJqmSfuH21T5AhQCNVdbCtRFEiDp2Of7rZzW6SAur2WpAWdljm5jHgWDavc8oSVTxHfnG2LF3UTKk%2fl6G5TyrBVmyroQpcCFBPEK4xMwnUlbqb6GaP7IaYOEhQFmzgTFAaJIkQ%3d%3d
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a6a46f8,0x7fff0a6a4708,0x7fff0a6a4718
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5214515746260350248,6749343543016421729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
  2⤵
  PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff0a6a46f8,0x7fff0a6a4708,0x7fff0a6a4718
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13693554390428492987,1803128196313948606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 99a91201c4f3eec07e3bde7f4cfcd57efc15a4f6fa366f2ef0653755cff4aaa0
MD5 2d0934c52eab20bc6784a7e39d0ca3e4
SHA1 4dc6bf36163aea8e77e40742d6f83fe0734069eb
SHA512 b9023772cef77f06a6d4da29704486066465cc9ac8a1ae8f83e47dd222ceeb79b62b6557e9ac8ee3b59bb87b5eda680b7045a12f5a23cbbdf54cb9467793e703
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 65a81412cdf8e8193071f7fa0f17db4c313c96551d20d29f0c921f6cb828f9aa
MD5 4c61a47e068cd2d32875d2f4be6ba422
SHA1 c075bb2aea18818b19ab0b808f38636ef9bf4817
SHA512 ae1153db63f220ec8364e90250ee4fab4388fbfc581c32275a25481f89c2c0bf306ff7ed0a1b4b910d1c432caf8d203c9121b3ea7bb4c052a03132244c0996da
SSDEEP 3:MsFlYhXllLlX8ljp6cv9H+cl2b:/Fiz10VL9ecM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 076898ced31601e5d164103f18436da0d997f1f16d8bad34411b87eacc006900
MD5 c09d30325234495f1f9fb65b151c3cd4
SHA1 2c28874ed06013d6069102b9609352956a8b31d2
SHA512 f790a85348e787b6adf9cc9e5c8859a0f5f95dbd7be0e5fa9844006ce2eaab61fd4d87c13cd784c262f3458943f5059c75703fc3fd46ca1100e83085f37cb29d
SSDEEP 6:/M/PXGuELyl/slr9//iT9xiT9xWMEbGjgDeAPDgLAWiXwMhc:U/PXumsjex2xWMEiUDekOA/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Size 1.0MB
SHA256 cd2db2192bfed9bcaaebb6b017643932ff767185a9752730152196bab04fe736
MD5 b00ee25d3aef21db1f220f12c39d5069
SHA1 91d95a5b7cc49f827ed28e5f30824ae638325c33
SHA512 41a0b4def02a8c37431d3c91c0ac94206713fb81e929a6b3e392b4c305e80c79d855bd1d84e7a766f8d246318a0bf36b6096e571e47d1453c4714196ef2be56d
SSDEEP 3:MsHlDllrll+l:/H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 cdb12af312e3eee3804e1befb8499faf1088f61dc0902c4f06118642365dd1b8
MD5 d5012980def5ff0ed2f79ccf59e6749c
SHA1 aed4ff7c88348ba9e7288fdcac2a9d9f07982df5
SHA512 771387ec386892279ab14e833fb85fafbf179cf8852afc2149e493111be6d4f7514ce1cf675254e0651b64a9a399cc15a7e0db62b35d97215ec33fc2d4a612a6
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 2e923fa5aa658355650d7f1ed24fbd1ba430ece112acaa3baf973ae214c4f36d
MD5 109c90862748207f877d19c1a8fd4d32
SHA1 a0cd142e916cee695b22a120c9b37802be1b551a
SHA512 9191d47cc1f8969cda7233485ee8bba7d0ebb2347189947cb8d302e5ae5d92e659f5aad32765686bca080c30cf2aa15a2bcb74350d973ce5a7553b2edf8f90e8
SSDEEP 3:MsEllllkEthXllkl2zEkl0J/:/M/xT02zn0J/
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 6B
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA512 41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 82f75af3147f44cc2f1ffb2ed9b5722c5603acb5d44bf38dc70caad5a471dc8b
MD5 fb30ce1d7b6fc31fc183ed20cfb27f36
SHA1 2e6754686c049dbfd4b41f09fd47189d47c9ba34
SHA512 372ad6f8a055ce5e0b6a3c7cd709b59e86d7b2e3f88861278d90d941dd0254cd3e443387c4ef9c25bcf1156040f0e315f11aa18474a7cefaab072520dcca9b8a
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
Size 36KB
SHA256 a9f70c2067b82be1a50c9489fdae311f3d7cfce95fd0ad20386ae06371ca49fd
MD5 d90c82dbc7fda8c857835beda988b429
SHA1 f97957df7bbddd89550ea08fef9503533a7c65bb
SHA512 631beae0ba979e3e4c05897922ccca2bcecc8f77d264f42a73ba98034eb733871f0b0e3d66cccb4e9968b6b46b886b217ea1f2fdafa1ee053f05b17c2267dc4e
SSDEEP 48:T8/qALihje9kqL42WOT/PuPEVfCEyWVNK9VqfV3V6Vl5nVOZVbV8ZMHQMBF:uqAuhjspnWOaPEKcWi1MNnAJyZMB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e4346d5d9d94ea16d969aa6551a88826aa514c29a92005db41b4b35c450ca956
MD5 3abb560968ee5df9245fb83f1a0cd8b8
SHA1 bc71ab42696779c1318d9652e4dd6106c44fad59
SHA512 aebcc00cdf64d56fe323d27301065673dd00c4eac1e2f824e597b81ddf368894008672447cac9b169976ef1a695b55134631ef01fca3b207bbee0d38adff5522
SSDEEP 96:n8kGlY13D1wpvWMoiVmdeHBrzMUWQyV+VDCziEwb:n8kmYhD1GWMXero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d4db29cb6093935abd95038ffe8364adeee02c4c55a6dd3319b8c82cf4da7027
MD5 23f0b9a650a9e207c19749bedd185006
SHA1 11220a01108d598bf387da19fed991b5baad8c19
SHA512 5734d3b1d91a3c9f97e02f44209e4ebe68cc7da5ef87da0ce33af746451dd1ee277c478419daacf7f9ad0888f6f56c7c0e429b479ce36e4d1545c9285b45baa9
SSDEEP 96:n8kGlY13f1wpvWMoiVmdetyxShPBrPNUWQyV+VD7AiEwb:n8kmYhf1GWM9yAhTrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dd5b032770a6c40349cea073e1e593a2e34fccf83883e46ad80e3ecba9f94052
MD5 f4a235e98be11b8cc59809bb741f6305
SHA1 709ce0bc53ba645f1f6575a9c6fc3f59fe5fa954
SHA512 a4db73e9eb9c660ef652dd65813261f5ccc3a1df7d7a0122bd8a15d5acf9c08ae83aa45ce21f020161aa257b661b63b3523e6aba08dcd86c895a017d01a79bf2
SSDEEP 96:n8kGlY13f1wpvWMoiVmdeHBrzMUWQyV+VD7AiEwb:n8kmYhf1GWMXerg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4cf72608659a411de7190bccb58fdb7a437ea780204ac6e184fc278fdde92b5b
MD5 ab53035546aa23aef49e05c7e1990c95
SHA1 eebed804cf307241186345cc497df6d1721da86e
SHA512 088ac3159a128fbc93d628d2e06d34757203110fb49b382b1e9de76f2e0408cfc9bc9faffb1280619029d4f103a84593d73bb4b3600faed79ae7d98dc719da28
SSDEEP 96:n8kGlY13f1wpvWMoiVmdetyxShPBrORyWQyV+VD7AiEwb:n8kmYhf1GWM9yAh0lg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0f809948b25c3f22e293db59408ab6360e8d88c2fb6ebb98ac334218c1a40f28
MD5 23284f25e8f214237dcd03fca3409296
SHA1 60d6b4d1c5a0bc439685929c124c864c3edef369
SHA512 42de79c3e733a66ccb9e8186d811233a6c347b78398f9eded48c72b273be2951d17f3e23854d89d3eaaff4132ee091131ea67d138b115dc0b4a1c634ad714057
SSDEEP 96:n8kAlY10K1wpvWMoiVmdetyxShPBrPfUWQyV+VD7ziEwb:n8k8Yz1GWM9yAhdrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Size 33B
SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
MD5 2b432fef211c69c745aca86de4f8e4ab
SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 137B
SHA256 c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e
MD5 a62d3a19ae8455b16223d3ead5300936
SHA1 c0c3083c7f5f7a6b41f440244a8226f96b300343
SHA512 f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 6d38ae02e89dc65b45258bd86361aa7ba52ccb58d0067682ab8bd9b2464e0e7c
MD5 51c8e40444c0694d4f63e0c9f26cc349
SHA1 1dbb66d02a4c918490edf7d937cc1378373edf03
SHA512 8afd86c36c6fe37845125adb158ebff8a41f54e5da2609203a2defe8a36c33314ebb66918dfa4e83ea5bd37a136ce5b0d3362da257f943beb4e84d3e2e1d8e11
MD5 SHA1 SHA512

Submit Download

Session_13362840593142307

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13362840593142307
Size 8KB
SHA256 1f194c9548b153b64a36576330ba28c7a9474530474c3636249ec8e04f482b54
MD5 15b7bd733a47102ee082c4145e481d5a
SHA1 6bdbad06757feb04e8d7d505d5a7b61576c7e566
SHA512 c1fc6655db11fa41698484da5e537377bced2a6eb1c5f208b9c183919c35006292ac912acdcd869b6be230ec25f27b97b776277f8a1857b971d14089cc5602c7
SSDEEP 192:3Jz0i1KU9N2W3NOhXnqemEQLWr/JIACi1KU9N2utr9XX7Fu:Zz0i1x9N5WXqeKWlAi1x9Ndt1Ju
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tabs_13362840593328307

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13362840593328307
Size 8KB
SHA256 d1232022ae9a7434d94a628fd0e6f28b2acd12e377536845b6f1204ee3e08f22
MD5 4065efd0a76c1518c63e501bcbc6adfa
SHA1 e3ac114e8ce045c4d3d9351d7863c07c2c901c66
SHA512 e4d34b950ce213fae7c8c6240a586458f2a0d7c6fc073e90997aec0e9981f2cfb52fe6cb29845341b74ef156d5aaa8d31496d3263049723a25851181e7f1dace
SSDEEP 192:3eU2417F/i9XBii1KU9N2g23NOhXnqemEQLWr/JIACi1KU9N2uZ:F24bcBii1x9NaWXqeKWlAi1x9NdZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shortcuts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts
Size 20KB
SHA256 c6dde84fb40fb69d1a6637fe6bf781de51a4c24e45b616e8f97afd3c6fe200b8
MD5 fca621466ede4c2499ecb9f3728e63ab
SHA1 3d5d4cd0fa702371f9d1a40e72e1fe19d194a3c4
SHA512 aa12ed8c1ff85af4375ac80d7fe494d6f8a70ddb3357c186a0c1ade9bbcc3efc3de5fb0ad4b81eb2ab9bc916b6adf8b76c30203f78e38cd00af5fa4ccf3e3760
SSDEEP 12:TLiNfscUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLiOVMnYPhIY5Qlvsd6UwccNp15fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 15817c9197d2faacbfc888387e11086ef3abc002ef509b8fca1cb44b77c11445
MD5 a0f3205ea99a2cfac8ed9d91fcbbc515
SHA1 aca8faf24f61d61858708886e9955ca06a561f8e
SHA512 8a256161c9bbef7166bd5cd42ca6b619a4bb680e6411e545ff199d832b5253743a477b46e13b7849f3a251f64fe9b01bba76c0d5805fb9a66ef39921a02e7e65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 476e6aa43d2175169c799b609dcd1ba0f4baa4e0516d3d975a8144e44b81797c
MD5 fd16802527ffd77bc7dc7762ea15d4de
SHA1 49694c936f67ab0673e950f0a248de071d4592ed
SHA512 9457aff594684376d69c624a69e71fce53f77281a6c3454ff9102998e2e115d52817b85fbcfd6e12f8a99a4cbc0f7b986dc11f876af561843c507d86253a962d
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b49c8d79bcdf80bcf6ba92949263a5165cf69215fdfd7f867b47479b0471d602
MD5 5c899d97f9c8c590e3dfcce3f6ca54b7
SHA1 199372374b82908f5e20ed1936028004c2e59140
SHA512 fca0663c79bb4232144129f9584044eb0defb4660ddeeb853856720b8839219943a41cdf9bcbcbabe85b18a52974b0cc8813587d7c1d78686c43065812370b12
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Size 136B
SHA256 4339ee2030f55875ca5a9accd8a9056aeffffef9d37c92c2cd90951792d6eb92
MD5 ab7b8e6a2dce3e1194b373dfab822af9
SHA1 87448e134ec85bf906445a2289518e8e71d9ed62
SHA512 3b563e1f5ce570249f8f4aba456e421492bcaa97f21aabed64f8a46a2e4c76ce9b80aa8996d1fda65f21ef8ab911ef7c6081fe21ab463090eca98051a4a86db0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004
Size 50B
SHA256 b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da
MD5 031d6d1e28fe41a9bdcbd8a21da92df1
SHA1 38cee81cb035a60a23d6e045e5d72116f2a58683
SHA512 e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 f5457e2e44c02487c44f2dd4ef530a157c4f085ba604e1eb1731d5e22570cb10
MD5 d2b3a13900c8d6afa3b2f80191e9e665
SHA1 61fed57c132d888785565faa1761a5a7c244f716
SHA512 5a564d1ff7699a7667ca6d7d7acf0ff81f934c723ea563072f812ec18edb61b12a47c06bb11a5838b922dfb162ede8aa93cd4ca763d464e1c677294f38c0aa4d
SSDEEP 48:TtUYVAKAFXX+XwdNhyZG9gWK5whyAAH/2VDcEc:4NsXUfymgdSyA+u+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 187B
SHA256 5c979f818fb5606f16c43173e6abd3ec2cdbefc4f94d8913bc07317bef8871bf
MD5 d6b1e62d829d6b54ca57db17c1344019
SHA1 5b10b0e4fc29b37328aa44db75c8a282a1040c54
SHA512 0e57f7c61ec047ea29cfd4aa3fde6ef5dd1488066cac5f4a5c315908b61b60179971c8be86172472eb3f67f09f256e426626e752a8a1f8f5474b967678ecc0ca
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 5fe420804bba3f520e5c7d113c37e3874e327ee9df73595ecce08202878982e8
MD5 208600f1063f435af88ffae0b2ac0406
SHA1 6fe498b461e0915ab1a5b6e717504505a618866d
SHA512 cbd23bf049d8848861ac817d12aa68815d6a1f20b59c4ac7e2e2238ff7b75c0059332cf461247a59f457a86b10860befd261dde866e230421cf757e33a73da91
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 565B
SHA256 08c18c595065ee55d8a49cb41f8d7c2f5d04bc75791d806f2c087da2e318e7e9
MD5 c7dd5dbe7ab6f5c9698d12e1607ab7ad
SHA1 346dc225bc82b03e39fdf3217b34daaf9aef5fda
SHA512 cd7204b86e3ba2195ba6ac154e6aada858ed247efef9b7dfe28e1de598aa734f7daef801d7209433ea57576b834953fc2e337bcbd81fbcb3b68ad3a7a1ee07d7
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e9f14acca4fe2cb4a456d700fb755e45bb64f3152cf3dbc135dd41ba161cd8dd
MD5 7815a1dcd3c342322ae132052f5f0a08
SHA1 ef877440067a43e22b6a7fb4c0be3b70c13bd8c2
SHA512 1d4536c2aff57de00650a29411ddc4b183d8597e968a55bc9f32dee721bf35a52ca28df717bfd0e0ef5c19506a085d89f80614570303cacdd33b505672230d2d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 1f4679a384381aa15a71b0262db6b5115ea5d13df00ae9cc0e972a25ea5a6698
MD5 7950f708c922dc4378534877784c1901
SHA1 c1500bfd7211f8b99f2daf33197027ca6c6bee2f
SHA512 cecec7946190ceeb4d7c31de2472f79604a55d6298e7b25a7c841a614e0acf4a26dc1ac92ed3563976c68d2ce29a0b385dc90c88ed59c9dd36e20df9488080ab
SSDEEP 24:dAslHEsfxBsJX/fduyAfQ1vYvKfn2kEVfklCedMqf/jq02:9H50eIH2kCOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 cd37ff05493ec5590b55971bc1119681f718fabc76c8a96332e570e721e84579
MD5 86b2ee1bf9e4aa3da262a823004722fc
SHA1 f61c4dde716a533a255e7ac834331d02273b879a
SHA512 dddd6e5e5d68d7c1ac66d0508045ad2918b99a7779fab05b26a7a35c0924bde59ae6466a28d16bea21f1490c8127f3a54e3c0d3bd4313d3ef563e55fac0cd245
SSDEEP 96:uyvjSyPjSojSdkjSjujSqjSsldjSVpzjSDzjSG+0jS7xjSDV7jSdbjS7NjSGVy5p:uy7KZmTyaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 e161c65c651a05abcf03ce9ac56b38f6c9d00fa0fafe25e25dd867b3612bda69
MD5 374d79946ec38b55f4c58c752ef03058
SHA1 b416ab31b4d127db516e3e68fb52047f4e73d183
SHA512 444ce71daf0c3d6725eba0d777affcbf0cc2663940add242fe0cff65cb875b57c6637162f741d6751c827f64a851cc5b5cdbc68aaf2c3bed5667242cd038219d
SSDEEP 1536:UI82vNFtYNDHyqLXWxLl8eoApXxQtvbJl6zgxzJYmqeZYu9il8JMKjloJURO6VO8:UubtXjLl8IQfrIeZYu9hn26OQqp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001
Size 17KB
SHA256 b0b478f9aa6aaf8d5811e296047ae1f8ee07f4c4998fe9d7b960755ea1fafb82
MD5 913728da90cf90d8e78af59c60b47c3d
SHA1 f42f2a545d4fcaf4f76d0f060f52e33a47df7f1e
SHA512 3af86e053dd56aef03e6f967a49b1a0d492616a71e2e49090e0c8e5cbe58ff37ccc55e91f06bf34096059a49f3de84b0bca587f3f17c366f97c0f7a0fd17c974
SSDEEP 192:JTNnrBUNIVNI6cjjOS6gYSIgH515m7s6aVH1yy+Q0FmN0RtIv/7KzYMvHhgvcB7:K2gYSI5s6C2oN0Ryv/7BMvBF
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002
Size 22KB
SHA256 4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e
MD5 1ac9e744574f723e217fb139ef1e86a9
SHA1 4194dce485bd10f2a030d2499da5c796dd12630f
SHA512 b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109
SSDEEP 192:NY5VVWBObOIXjv7nenqWXF14yEQ0yJq8lnRe8/kLog15n6ZbPPoSYp9gZY7Aemaq:NY0VIpWCqJq8l7kLpnqJYpCTem
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 779db23dc96b3f4845a1d3c984c6de16034ab123e1be0476032b8c4db5acdbca
MD5 d9ced06aa874f14bd6e7a7ac368659a9
SHA1 c1493fe11fecc989a4b02b515c6c360cf6746fd8
SHA512 a18fceb452de7fb2c4cf8e16bc92bf3e4e47ded373b8b3a52bdb0a7cf02f74caaafe029b9e6dbe2894b1fe3ca8f9a735af951aaf60439a304ee75c18afbd58c1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLHve2RUIMj23:A9iIxuERzA83h09RZxYLHXay3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d2ce902c203886cedfe4a9e6915e018bbb8033d38427059331d91f5874ca2ac
MD5 86ac447df1a5223181f0d7dd3ba48531
SHA1 05664052d588b6faed6f900796b5be92c4c14921
SHA512 5c71fd0d6db8036090b48f8f819267717c247660799ccc7b754e360efcdf78948efd345e48ae574c6a8b7e79027e6ddfdd242857897ec66110f31e218602db40
SSDEEP 192:LoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLHCe2RUnStj2m:79iIxuERzA83h09RZxYLH8WQym
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 5e64de4526879aaf94cdb69d88b175d850fd1ff9b08930af3f2fd541c9afae7a
MD5 cd9eb40c7b2db3b50630804646aea576
SHA1 0d7d21f121ddc298a214215c19a49d2012a00d40
SHA512 a91df6c97d2c461140a9f997892b9f89272b678fdd0683664de439218fcc3055726ef4389c20320a190844b4169b35c09443ed4ce97dad4c61b230d4d4b99db9
SSDEEP 3:MsEllllkEthXllkl2zEkl4cK/l/:/M/xT02zn4cK/l/
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 4B
SHA256 41500d790664853c4af5bcdfb8f6751da81515d5f5e783052347faec2af7d861
MD5 2a47767601c74a936e7c8b5e3743e6a2
SHA1 fa44600eac66528024dbe73fcf602b9d3096ddd7
SHA512 fe0018c7468f93eae71fa793533312cb4750c84968797b3564832d55ac6133de3a4a004cdb2e4d38f02d074311a85b6ecbf5793895baf347027c9c439036b6c0
MD5 SHA1 SHA512

Submit Download

9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Size 4KB
SHA256 aa61fe342583ee1b80cd4f94abfa4c5b4caa176e499807abb3594ce2382c59cf
MD5 0d23b6b0cc25c15a2e9be52642faf935
SHA1 3d6a96952aa98d49991713beded5de9995393366
SHA512 374b235cd66a129efc075689dbaa7dea4d8fba4545044e113fe066cb5ec6097826736c761dd12900415758ef07075b9d418c1fbc7fe1828367552b54218cde43
SSDEEP 96:IoYmxqzUX2//XwNIUT5MjlBoKZJl4yJJRl:Iolqzb//gVCZqyJ3z
MD5 SHA1 SHA512 SSDEEP

Submit Download