Resubmissions

07-07-2024 17:45

240707-wb1phsyblg 1

04-07-2024 17:45

240704-wbwessshle 10

04-07-2024 17:44

240704-wbhtpsshjh 1

04-07-2024 17:43

240704-wavf4ssgra 1

04-07-2024 17:40

240704-v85jas1akr 1

04-07-2024 17:39

240704-v7854asfre 1

Analysis

  • max time kernel
    62s
  • max time network
    71s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 17:39

General

  • Target

    https://www.youtube.com/channel/UCCmzcphyrH6Br5eNUnQR2mw/about/about

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UCCmzcphyrH6Br5eNUnQR2mw/about/about
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dd7f46f8,0x7ff8dd7f4708,0x7ff8dd7f4718
      2⤵
        PID:3668
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
        2⤵
          PID:4880
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4904
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
          2⤵
            PID:1852
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
            2⤵
              PID:3064
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
              2⤵
                PID:1496
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
                2⤵
                  PID:3864
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
                  2⤵
                    PID:2328
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3252
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                    2⤵
                      PID:4540
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                      2⤵
                        PID:3192
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                        2⤵
                          PID:4884
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                          2⤵
                            PID:2224
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
                            2⤵
                              PID:3840
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
                              2⤵
                                PID:3208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3524 /prefetch:8
                                2⤵
                                  PID:1264
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
                                  2⤵
                                    PID:888
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6704 /prefetch:8
                                    2⤵
                                      PID:3124
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4578095386736864832,2175701613411682597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
                                      2⤵
                                        PID:4412
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:5076
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:2796
                                        • C:\Windows\system32\AUDIODG.EXE
                                          C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2ec
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1040
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:2668

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            f61fa5143fe872d1d8f1e9f8dc6544f9

                                            SHA1

                                            df44bab94d7388fb38c63085ec4db80cfc5eb009

                                            SHA256

                                            284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

                                            SHA512

                                            971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            87f7abeb82600e1e640b843ad50fe0a1

                                            SHA1

                                            045bbada3f23fc59941bf7d0210fb160cb78ae87

                                            SHA256

                                            b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

                                            SHA512

                                            ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            936B

                                            MD5

                                            1406d6a77574d5a4cfc6f8022dde536e

                                            SHA1

                                            6dc6e7d085403d47bf4d133d6c5ba7c236cccc83

                                            SHA256

                                            d0e4d0f97223e9e5f1509b25fcc70d5e94a94c513f29c34035a7c9cd6fecb13c

                                            SHA512

                                            4a79103e57a5b63426314bf10c97effbc56adff64ee109816085768c7a0006c27891b511d661af90597134951a80a7c945bb5776bc50006451e154f915611f51

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

                                            Filesize

                                            41B

                                            MD5

                                            5af87dfd673ba2115e2fcf5cfdb727ab

                                            SHA1

                                            d5b5bbf396dc291274584ef71f444f420b6056f1

                                            SHA256

                                            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                            SHA512

                                            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            0c502c9bc138a3107d008674bd29d57e

                                            SHA1

                                            0e9878a84e33977c3cfb9bf7c9b87415fe6398c7

                                            SHA256

                                            77c186479831c7c542a2671c3e9ad945d1f7a0c7d4c4b49db1aeac66776ebfc6

                                            SHA512

                                            b907bbc475ea7bd8a75f85d916fb8884201c4d7425eff26d86e2088ac482a272eef03d6e33d50b20bf4a8049552976184e711e53bbb58cd2a10a57b39863245a

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            348d4484ab07f9c00de461c87bbac3fb

                                            SHA1

                                            1428a8c1bb4f0eef952142a3f820ced4583592a6

                                            SHA256

                                            b5bf4932c2a55009ddf20b702d50cd6e725cb239b185a6b577d206af34cb2921

                                            SHA512

                                            12714753151953bbd967ac5e7ca0501b758b058674ea2bd245baeef8634ea9e892315a5fdc8642b9648d02c5e6d57e7395011c95227d2b727bfa2c2b5aa3de0f

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            7KB

                                            MD5

                                            2685a04ecfd1646caf9f7cfb556010e4

                                            SHA1

                                            a5773ac743dc823a6b0e0261b199d9357163b363

                                            SHA256

                                            becd22bd73543f1e419009a35d515bd99fe934d11fa011ffbff6110606fb21e5

                                            SHA512

                                            f56f66e7e80dc10802c5c96f043ed0b2071ecddaf7452c9bc2371ad8380748bf25adbef6a53aa24d1f1753fc5e5b324412e8e649e7ff466725fae87e37d9a220

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2ad645fd-882f-45b6-98c3-6a884911a392\index-dir\the-real-index

                                            Filesize

                                            2KB

                                            MD5

                                            dc6cecbc1305a268df2342a09d11a1bb

                                            SHA1

                                            682def1da909624d28604589e4c085e84fffe7c5

                                            SHA256

                                            d5a64f3c4c643d0926c6da65cb80151541dc3002afc8327c4e5a723fd6ecce10

                                            SHA512

                                            6f0de5ae8748564daacb4fa582a605072d339ff617ec2d06eb79f3dacd5e5cf4dcd0e58e235fc61ea6bf41c6e25be05cab6320696b99ff8c7c07eb204f17bf90

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2ad645fd-882f-45b6-98c3-6a884911a392\index-dir\the-real-index~RFe57b5c3.TMP

                                            Filesize

                                            48B

                                            MD5

                                            9eef840fa8d3f27d9dafe571f70c8f58

                                            SHA1

                                            085b9e28bcad284b7566d441f40addb0258f89a7

                                            SHA256

                                            4ab2efb7920523ae7725d2fabafc00cf85ba975eddc01b64a0f6ae6e8990ee9d

                                            SHA512

                                            74b2dbb9b57ac484944e9b2b8946160bb70f49ee748a1564b610fdf43a84031c2bf7fe8a861cf32017ad43ce60307b009bae2b5d91229bdb14e9c884fc497062

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                            Filesize

                                            89B

                                            MD5

                                            4814f3837f732ca2337df458e203027b

                                            SHA1

                                            bcfdf0a54ce48acbc4eea619fceeed09289102cb

                                            SHA256

                                            999ff506e3cb5422af8680daa321f1ea3ad3977ab3a5e371fba13ea0efd6a2fb

                                            SHA512

                                            735d05864fbce998483889cff660f0165839f75269ddfdeaf9f4df751ab2215792e42ef73a336e44ada5bd168a6931a58af3829dc81cb7e2141ff0fc94ca51eb

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                            Filesize

                                            146B

                                            MD5

                                            00df34fafe0a50f784a8acb0e650684f

                                            SHA1

                                            d89d81ec7cd53eef5aa3676e6e2a036d945643a6

                                            SHA256

                                            3f4f6bee209686be013d21193163b73413e4d594b161c1b40fb827df458f8a09

                                            SHA512

                                            e83603f40be085769bde4f4ea003fb2f6eb73c9e5aef57365333b5500cd01172a5182a10827a9c2bdc9765bf5bc3d0b26efb80da9bb5a89006a07204ebcae024

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                            Filesize

                                            84B

                                            MD5

                                            64a47167d7f1f285c4583f69273b6532

                                            SHA1

                                            2cd51b7f3db0fc9dda3206c4fbcb07102afa1983

                                            SHA256

                                            f8235b040d9b4cbd7547ac432d6877ec840e75b1bc32db25c93b39bafd96e6b8

                                            SHA512

                                            5cebec912556c7a34c4b4b8f1f7a2bcc9a08cafa302a53755cf1f5bbb94176004dc3f680bffe4b5b926c2c148d1abf0967cf0c08e3b804dccfb6104d4f0b6e26

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                            Filesize

                                            82B

                                            MD5

                                            e0a53787d1f33f459c123051dae652e4

                                            SHA1

                                            8eeeea1219d5687a702992b58ffa8e67c019abec

                                            SHA256

                                            4b787aebbdc222ca75e5a3686c45c6f999524fb4087e7068a191d9347bbc9172

                                            SHA512

                                            d39f1e21787c405458d0d0830e2ba906c5f973acaaed66dcc7a03221c00a9408aeede657a5894f8a034b0f1a5f30a13f90b24163016d5481ff237e5123aa8fb7

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                            Filesize

                                            72B

                                            MD5

                                            2ebc5187729216b79000590425dbb281

                                            SHA1

                                            3136dbeeee3f9d61f520a857eaec41b0536c43c4

                                            SHA256

                                            d5c2304f509e6378a58384a6ac3d032a3e540b87428cd1c252458191802a3088

                                            SHA512

                                            dfd3e9ed3eea97d1cd7759b069243db2c5f1a9cf7a3d86745f706e13f7d5880d4054064dfb65e241eb2f17246dca0f50626fb198a4867343b9a09f77c78633d2

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57af6a.TMP

                                            Filesize

                                            48B

                                            MD5

                                            095dc1914488210ece3546fd2eb1385e

                                            SHA1

                                            c7ed2eba618113f56323f6a1f57c7a5bc760d09b

                                            SHA256

                                            dba595db4ba25b04f22f67d59c2de79a7a9152b44bfcfa99a2932d2e5b6910eb

                                            SHA512

                                            56c34cce8a3eb5cc34bef4f2b44289b69f0fe41447fe92c1992528e867e2fe08091479c0a77b958f8c361fc6c373616b76925b17bff51329fb6033fe456073aa

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            1KB

                                            MD5

                                            13561d9e374852bec1f60d7ee8dc6173

                                            SHA1

                                            f92d6342b1da851f551a5c62b563ce37d3f51cc3

                                            SHA256

                                            a160d6ad6ae285860388b7214e125f12689fc4987ad00b5c264e3abc38d316c3

                                            SHA512

                                            b0fa6da81ced94733097ff1df1baaf3d326de511a8aa346ff4ac6dd211968f73abcbe39ab07677c5961b68e20555d60d343132581c7681e091affb31f6d0699b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            1KB

                                            MD5

                                            5a36e13ad5a16390a1fa685cd914d096

                                            SHA1

                                            4c9f4135052c1c05db4bf3ec72b9813eefed945c

                                            SHA256

                                            bed2ad81bf76383638409043e27af2830657791a2339d90dbd4b8283b92a79b1

                                            SHA512

                                            6852c417152693bca0e76426561cde94dcecb0d49f9a7941ec09065fe479f4171870a6a2a80bdec0b0b5089c6de6618faf038f9ed00af97b28271c213478702c

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            1KB

                                            MD5

                                            16bc9a87d634d86fd10f6a50eea1e030

                                            SHA1

                                            975129648e61f20b589f98c0756fe160044b41a6

                                            SHA256

                                            2805cb19dc5b3a4d730daf866012087922fd423cce01c615f3d83193b41aea35

                                            SHA512

                                            aade99c45c624b0d89d726da99e13e22dae865e817cba71602d473f9aa2e0783c068ef9915d7febc0cbf26e7d4463b712234e48eeebac2a09f74dc5ad59f3805

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            1KB

                                            MD5

                                            4351c96488fc5c88481934f7fe704161

                                            SHA1

                                            3c0f233d8ac534e70164c8eaabc22f3e559a7a45

                                            SHA256

                                            16ff4ec21f3edb85f043414727966fd11d91cb0a769a6a67af24c72a5b590c6d

                                            SHA512

                                            c5e7b451b72ed79471b0e2dcdcadff23c9835ac477d049edc948d850b517397fa24ba3d20b8798a5090a1a295471f8c625f7e073b7c497f267f29ce7046a3bc6

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578da9.TMP

                                            Filesize

                                            706B

                                            MD5

                                            1e01b571282ea423ed2900d2e3f477f7

                                            SHA1

                                            192150446f13237bf0b112d6ba1af2fddf84f719

                                            SHA256

                                            ab772788a6d7768d8486690b2f34e0bf4d00766873ae57b5f619181c63fe7379

                                            SHA512

                                            f210d8ab1ed97824309a297d2a5dc2e92aee3bedf72cb7099500d045e566aa368fb4c0a7d0deaa2670bb09b7e637417611b85d8ccaac388bc405e2f76ae840ca

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            46295cac801e5d4857d09837238a6394

                                            SHA1

                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                            SHA256

                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                            SHA512

                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            206702161f94c5cd39fadd03f4014d98

                                            SHA1

                                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                            SHA256

                                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                            SHA512

                                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            10KB

                                            MD5

                                            e2403eed4718fc1e76c375c246c6ed5d

                                            SHA1

                                            2f9cd522bb238e5adb39e565c297aa6e8fd8bdfb

                                            SHA256

                                            ff562a0f3d4777493f9de45edd34961e94e7b0539ddfe0a9b4e385eb42bfae96

                                            SHA512

                                            76d8c6f6125be1d810ffe035cb3d6d1f00a1efb77a0213b1fca2c351fa0c9f854710c4de976d54a64c843b1fe398b733ac1661b80d814afb1328320ca4ff4dd0

                                          • \??\pipe\LOCAL\crashpad_4300_XQVFRUBDVZQVTDJQ

                                            MD5

                                            d41d8cd98f00b204e9800998ecf8427e

                                            SHA1

                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                            SHA256

                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                            SHA512

                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e