1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

Analysis

max time kernel
150s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dControl.exe
Size

447KB
MD5

58008524a6473bdf86c1040a9a9e39c3
SHA1

cb704d2e8df80fd3500a5b817966dc262d80ddb8
SHA256

1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
SHA512

8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
SSDEEP

6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2984-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2984-23-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3028-22-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3028-45-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-138-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-239-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-240-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-241-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-242-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-293-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-335-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-336-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-346-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-347-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-357-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-366-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-367-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2036-391-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2984-23-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3028-45-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-138-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-239-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-240-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-241-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-242-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-293-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-335-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-336-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-346-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-347-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-357-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-366-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-367-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2036-391-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2984	dControl.exe
2984	dControl.exe
2984	dControl.exe
2984	dControl.exe
2984	dControl.exe
2984	dControl.exe
3028	dControl.exe
3028	dControl.exe
3028	dControl.exe
3028	dControl.exe
3028	dControl.exe
3028	dControl.exe
2036	dControl.exe
2036	dControl.exe
4504	msedge.exe
4504	msedge.exe
3144	msedge.exe
3144	msedge.exe
908	identity_helper.exe
908	identity_helper.exe
4040	msedge.exe
4040	msedge.exe
2592	msedge.exe
2592	msedge.exe
4756	identity_helper.exe
4756	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	dControl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2984	dControl.exe
Token: SeIncreaseQuotaPrivilege	2984	dControl.exe
Token: 0	2984	dControl.exe
Token: SeDebugPrivilege	3028	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3028	dControl.exe
Token: SeIncreaseQuotaPrivilege	3028	dControl.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
3144	msedge.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe
2036	dControl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4360	3144	msedge.exe	98
PID 3144 wrote to memory of 4360	3144	msedge.exe	98
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4484	3144	msedge.exe	99
PID 3144 wrote to memory of 4504	3144	msedge.exe	100
PID 3144 wrote to memory of 4504	3144	msedge.exe	100
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101
PID 3144 wrote to memory of 1336	3144	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\dControl.exe
"C:\Users\Admin\AppData\Local\Temp\dControl.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  C:\Users\Admin\AppData\Local\Temp\dControl.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6aca46f8,0x7ffe6aca4708,0x7ffe6aca4718
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,199322764422894956,17547135468808690678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6aca46f8,0x7ffe6aca4708,0x7ffe6aca4718
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2362796757756109168,8184813928212333724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f270865afe8cb2dab4f2b0de15982a

SHA1
af68b3a48b194338e48a24a798daea806c68eeb3

SHA256
df28b23af4fd971e87cb8c037a6a710f4501687716a81603232f15bf5c07fec8

SHA512
0f2ec90c9ed604b2d905b59867ffffd67efe4c809b19caf3fe36ae0a9b13863ed8846aa4fc656f59857d039698b69283f1b2e7dc742702e401e5a8c8367c9d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c26897b8c45d075e53127f1f57b7bb7d

SHA1
e71213cf387e5d3081f8d99298b669ab26f0fe31

SHA256
6730d68255703c2e21907322cac3d09d7f1abd19fee4a0437e99a746ef148185

SHA512
aad42a6172dd9fc3ae47de8228a0d183c3f6764387bb01e60eab35184a11697056e2feea2418cb530085bb45660e9f403122026d1d58810b176b95369b8623ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ba2e9c8-8755-4b99-a227-036aeb6d1cef.tmp

Filesize
6KB

MD5
5026c17943fbbaecae9bc9a80ee71807

SHA1
f6570f40b1436d5b3fe82189e824816a83cc3d15

SHA256
2e17a42e48eb40be2ea3d2087ad36077e7d90250bc9b967ef1d7f00b0aad866c

SHA512
e85cd3c5349e93eb80ed140c7b211b0d7d29537dd2afc6671da529ad3c8b701167f57b36278f6d7545ec161220057c8856049b559c0c1489e5f43a024cd0dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
2c2da5d1ab74481c06293d2e14900390

SHA1
9d6c0b27b6a17f64fa6095a993644eaff7fb44d1

SHA256
881607a5934c065c9da65742cb74ef676b93b739a7cbaa56bb756d8f6875be82

SHA512
64f93d821dc4011329b7eeb147a901c013fee56d8598308067a46c786b26c35664d704ba0829b5a1d44117de2cc1f4adde642a7fc611cbd5fb6b6161df5a9fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
ed8e38e31a257ca76f969fdc0a8de73d

SHA1
494e4e5cc58e0ec73a605230499ef316c49056dd

SHA256
26c50ef0f4958bc72fdc442b081af9dcdb3d4f97a9a8a21587b329333c10a0bc

SHA512
694699066c9d44db8f069440b3d38240b734f0177df8a3b69cbe039f82e69d7e00161de73351c9d6332f2cb48121667ffd5622b420ae23bb67c45e0a528586f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
9da5a3a075bca12e94560a2a60f6b198

SHA1
ef1c0a07d880e7db1a79b910b01350c6dc752803

SHA256
7f78566f83d00eab72380430970dfd94558c05cd40ef1a67c0886aa72109a8ca

SHA512
e61c10282a4f7e9a9c659947901addb5e380b7ca8c8d9de19b572c65700008e3ac6bbdda88dc8660ca80c808c6d1963271a444c71e33f9ebce2bc7c3eea127c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
29dadc045a918eeb85e5414e636cad20

SHA1
cf6e868b3608a01a2c3f8741b89c5f1310ca5f95

SHA256
cc2cacf4e2e044fa87d55fd5315f256679a73abc0bed88854c65d3e0808196e3

SHA512
262afe07eb4f96394971eb4c9af68d862e087e78b376887677ac25f691bbe7cc777952f32f73007d96aa6ccce28b71eb2d3092b2f95a96972d72585074186f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Filesize
36KB

MD5
cf4b0a74bdc68a111bd7ccbd8569daa5

SHA1
e567e83b8db5476018dfed63802d0f60690c8139

SHA256
f79fc9fca22eace1d33311f380f135b75b30baa639f2d819fa437580ef268b6d

SHA512
4ffda967282821d319e22334cc4410eb8883b436654c2ffa65a7a75fdac296a349a672c734e8fed023b9b34d5f17d1af611f81d433108f898459b5ae412dac9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
298B

MD5
3b3efca068f04a5e32c055f993d6d071

SHA1
e4057d6f0ba3d15fdee4f0807eedae288b955763

SHA256
72f53a95993082c74d6687a63710719b33f78afdb34249ed50b5c55edfccf3dc

SHA512
658efe8fc74a8169087e370efb899bd7d3408c9cebe83e96a7dfa51be46735d04d26cf0ff534be5ba41859c999422c957a896877522311238ddacdc36ba3baaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89fb7029a7019dbf457cd78677e81630

SHA1
2ba26f146815e6582e16888d1d062ff1d7fd8eb2

SHA256
f96ff3b658d694b6d88e64b1ae86f1e1fbd6e0a57d032349d39b1f2ae6a9067c

SHA512
64f8df4d22e615326b823d374057d7fc73dce73ad0de62a51680b69d7dfae9a922b9dfab5e4da54591bb2495748cd9455272e9bc67b2315fe78febb1a14ef459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
348bc9ecce1de6dd11df6ed6a191152f

SHA1
c5ed6b13340a39fde86c202f3e3a328f5a5496a2

SHA256
355123bdeb006b5bbd228664302cb6ccc13ad3f5ed63e4775ac28b2b1e608f90

SHA512
b1b24b823d82c55b5210d9117b9148ddf2042e43194f45a9c875701f414c230d7e756b8fec6d96a7ec14d577e973f73d86b186f157c09f0c0f604c3f0d5d498f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a5a2737144c728c819126f4d44d1acd

SHA1
c9a051f582fbd27dfa6db3f76fb50774d4fb1e0a

SHA256
73504e7753b8e99c6f41a0eae399c13c98786cff2b6a6ce6283efba0cbd13f2d

SHA512
7bf464c280578e582ecadb81054e323e1154d4aa03f6afb0ac196ebf7091d93f504ce0cdcdcfb36b00ce8dd2bf8a60a317cd3329107bcaa89842eccd28fbb8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24156d16605fa62adb2ff546edf16c2f

SHA1
c5b235b9f6028c747843a506f4846aaf749bed47

SHA256
f18f489bacf600e8e8c92fb356ae05d25269cea0aba35b3b1527a9dd9aa5b7be

SHA512
2cf4a9e2e35e774c02f827cc52193237c3a78ddde5e8b7639ab4568e198d56443857f4b91ca063eb602a391770808d78c8e001062145786283c801b41008371d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
156B

MD5
fa1af62bdaf3c63591454d2631d5dd6d

SHA1
14fc1fc51a9b7ccab8f04c45d84442ed02eb9466

SHA256
00dd3c8077c2cca17ea9b94804490326ae6f43e6070d06b1516dfd5c4736d94d

SHA512
2c3184f563b9a9bff088114f0547f204ee1e0b864115366c86506215f42d7dbf161bc2534ccaee783e62cc01105edffc5f5dabf229da5ebd839c96af1d45de77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
c9c1f60d2fef5a586ab80ba6de89218f

SHA1
b12b44f54c527b55a4dbe56d713d58343581d083

SHA256
504566b6b4c8818be233b1bbe023305e8472edbfcecf9f6ec2e28fced7f0cca6

SHA512
506a3bc3f2a2104d90defbc2015ca2253f6ba76526c213318e4f56c245b682c38e551ed132e459edc6f743ad386366514d1befe32b97bfd88db6635f517349cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13365259337896180

Filesize
1KB

MD5
5423c90f5aa9a028c6c502f3b64e1710

SHA1
b540163c0620f04994c2a5cf577a53cab27e20cb

SHA256
051922d3e3b900797027009a50b720ed8d582b001706fb7ff067d0309d08bf36

SHA512
842ce44460ed7bbbb284ea19bd7d59cc8ed73991ece25d84319383907e9dcfad658fad826a1bbe5035a48f0680d8aa25e4b0e57e81c3564d2ce889d83586c3c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13365259338047180

Filesize
1KB

MD5
ebe14a9005ba43aed26ee0770e4630b4

SHA1
c1c86cb7294553073a52f7cc1e605196ff9b9b05

SHA256
03cb954052bd7745acb408ae7ec8237545108dde0afdfaeeb79056f8338c02cc

SHA512
6ce52d433b259bce756298192df909e23d93a4026bb90e806a243a29aebb24ee15c5ac70c08ad912093d07ab659e20376bd385f5a8ecdabea575643bd8c6036e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Filesize
20KB

MD5
fca621466ede4c2499ecb9f3728e63ab

SHA1
3d5d4cd0fa702371f9d1a40e72e1fe19d194a3c4

SHA256
c6dde84fb40fb69d1a6637fe6bf781de51a4c24e45b616e8f97afd3c6fe200b8

SHA512
aa12ed8c1ff85af4375ac80d7fe494d6f8a70ddb3357c186a0c1ade9bbcc3efc3de5fb0ad4b81eb2ab9bc916b6adf8b76c30203f78e38cd00af5fa4ccf3e3760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
88c62157e3259e9ca3a64dde5d0981bb

SHA1
a0e21b747a51ab587b546d664f19d16dfa5c4c30

SHA256
c6f4e3f50577749731748f335da68ec7c10df11fe9bebb37ef67ac6131568cd2

SHA512
4126fa52f205111d198f09020433f202eeb5a5b6cddad0a3b8d1b54e44d649a6642f88e7a97f87b046b6205d9b572038b5ebf286b1638c5bac662a879aa7d37f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
ba747cc1c0f20c85af02c30c15c021f1

SHA1
92fad1b21cedac713d44d52af55a2ce178f94d3a

SHA256
229d7a07e48b4e3fceab8d5d31b5f9f66408f6db1aec44e9b0bd0e0aa7aa54e5

SHA512
df8303ba6c7761408c789b9b134440975835a3b6287c037abc0132b4fa84db0747ca2b68f9265f5691d2be07b465024bbfd3fbc1f97bd78f2a99a6c36069acd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Filesize
136B

MD5
64539c83249f4d76a76beb0c66369ba1

SHA1
137c34fc29f1d1108efba3190d5cfaab0c61f987

SHA256
5ba0312b92df5ae86a1dcd5f2d420a10b79948aa7bfdbf881496f0f32bc34e60

SHA512
050d78305097555557478e4b18dbdbbc3f1639f010c3d0e7f902d5a2bce9f0a80849c1a78b63c1d7c9a2790a6939d87f2e014ab1f5e9bd4cfee9d0728a25c400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004

Filesize
50B

MD5
031d6d1e28fe41a9bdcbd8a21da92df1

SHA1
38cee81cb035a60a23d6e045e5d72116f2a58683

SHA256
b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da

SHA512
e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9e02552124890dc7e040ce55841d75a4

SHA1
f4179e9e3c00378fa4ad61c94527602c70aa0ad9

SHA256
7b6e4ce73ddd8b5e7a7c4a94374ac2815d0048a5296879d7659a92ee0b425c77

SHA512
3e10237b1bff73f3bb031f108b8de18f1b3c3396d63dfee8eb2401ce650392b9417143a9ef5234831d8386fc12e232b583dd45eada3f2828b3a0a818123dd5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
8612c6e742d8bcf6cbd0666fcbab7f73

SHA1
37653848d66a4d08decd8163e91c6fb0aa424c07

SHA256
fb9e03d3e063f6ca1e7a9d74475ebfee02a7829e13048badc22f3f49ee48df03

SHA512
2d9806fe36fdea10d4551456ae3ba69afc27e4ecc97da6c12f54de1ac963072a966fbc6986bfdb9abda7163d0ff1328ff7748cc6e5d775efa450d7d0391faada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
187B

MD5
f3d8ba6ccbffaf03a33c6bea14b182c9

SHA1
a86087fc1ad994a5770e0489fd1b75c0bc583e3b

SHA256
d0df4e3c17097902f17a0758172b382b9b68744735a388ec8eefc8b8b246cf94

SHA512
fb0e9ff0c021624bef5eea864188de3a2dd3c1d984138dbeae1c83f9b315c21d5ba6099f139e140b24cf765151d2ef8a78817d662b925f8055dcdf00b31cd35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
ce38ddbf2842ec06141385226ba1825c

SHA1
8c3c629de25f3fd9b498e120cc2a69a37f897bb4

SHA256
7c53d7036d908caec8cfeb623616397f962efcdcf4652d93b8f9bf6e619f960a

SHA512
5a946728afde19baf7338b699a1627a32f2b46c65685b922ff72b6e6677a0eb370d09c3dcaafd08809ea27f6dccac6f1f50ddc9dd6b388179dac043109dc94b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
565B

MD5
18e37363ffecd3e6aae2eb3fb92c0d68

SHA1
70c16bbca479c807757101b0fcad72dbf2be46fb

SHA256
78678057631736b0ef388d95519ada1bcb5b5c074b24765a1374f79b5069ecc2

SHA512
07132bee24658443192f14a1729f8158fe95f7c9514fd417d4f9a8c6097a588b9bc855ec08c2328b5db032fd54b6a9df413a315b496a6e2644854ed756638646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
bbc9cc9831374508e7cb948940b89359

SHA1
dbd881ab297157f122689bf564b8b8208c4508b4

SHA256
be5a5618ed9470b5afc07e3f3c7d1a2033501c5c9965d77649262958d6d47ec4

SHA512
f0758eafa96acac2b77e6b754872e47836f343dbc2d3240aba2652b534192ece08fd6b1010cda9bcd08a0e91f7ea1ba800efdbe8492ad22c3bc5b9ba3ee858ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
8c01d9382705430219812655aeb1fa59

SHA1
8da58502ee2c7f711598784278f949df3a623f25

SHA256
a08f088c4d13a32899873514e6c76117b9d01ffcc471f13f9b99c4f78101b8c6

SHA512
259592a7ecead74042ebaa7223abf014a30b00c605d1d8ef1088df5f2b3e69e9acdc8440f6a2076f69b8a1b009f17a339272b91746f9fcfe98446c63f84b4c0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a784fba8c67ca03912c948767d1cd13c

SHA1
6505103d71996db3aa16627b5f2e6b3e98130929

SHA256
d436dd8fd08dbc1eebd0de03e841257f39d2f9de0cc90a8648f223a7f6fe5b87

SHA512
13f37c1ac1d286a4c7e31fe5c64ada8e3f7b1867bb5a1f8c13e62dbbcbd22cb7bcec727f2c0e34d2ee17330d3c4daacef9088dd140837f003c9f2804c2794acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
fc17e8274fa2a6b393f91397db3f5349

SHA1
313691ef0773bdfcb037a543f1fd7b06160d4887

SHA256
ed4ce5e8fa0a8450c91e9b736a93d1b552b38d1b386cb731f858e59a3aef265e

SHA512
65d9f78b817f0ec098330ec519cb3ee901aa3aaf32f597b6bda7eb5394b3bd82c79e2c07c9f0f8d4c53dd876f6d21bf6912219f777507cc823a394ad1e2bbfe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
22KB

MD5
1ac9e744574f723e217fb139ef1e86a9

SHA1
4194dce485bd10f2a030d2499da5c796dd12630f

SHA256
4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e

SHA512
b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
056c5d79badc0634c27e12252a29551f

SHA1
45b89c68ee2666e0f3fa2ce10cbc241d910b9daf

SHA256
0b6d4579c780397a66137b732e9701643990a50ad9c55fb2ecc420865210dc4f

SHA512
fb35201ad07d8cae22c5d57f2fd7d69c71304368bd6e973e9d3469a1e34b0b3602aaad61a3e764ebaa60108cc11824e03e1aec5a30b4daca65bc4dcb30ee65e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
244ac6ddd9f4e8ff23ba3a4b02e11664

SHA1
9876a2872a0626e5365edf9d077f41bf804abe82

SHA256
953e5b80153f9841e6f03b2d83412553080ec0bce2df26ce45c74b6e831b7040

SHA512
202ccf7097ffdaf11bc96cac5f0cd0b7fc06ebdcdb48fc8c9aa33b579424a23cb6087d4d8692b24c747ee1946f9eb349b6fbd5405b5bf7db9fc86a07a8c042d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
6dbaa0c3f46296acbf0caa72ba791f28

SHA1
b28d157abb4811621c7cbf8459af9c892fca4abc

SHA256
3929c7583e7038908e39e26983cfb09addaecd78622ca886479b67e33355e0df

SHA512
55709c389610af8927cbceaf89a9a2a6431f68d5005093e4cf2f177d9b7e79f18e68c64a02088b0d4ae056417e8722d6a1f87f2db439c6141af5307977800e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
7fa5410274a377bda2c266129d1dce89

SHA1
44c1daa5f5f7aed203c589b78569ea79bba78567

SHA256
86e5f6070e0fe4e7afa2ddbb359a23b3701166ee123c5583d01c451a53f72a58

SHA512
d900c3e7cd6a485e60739e71898d1f4f8e95db491c5c81793de769d0e3e7bc0c74f415da32a38c814f7c4b8ee7336c8b892db35f864d5c8a28b99c3331cbf6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Filesize
2KB

MD5
30a3de896a728551c1021ff2c372205c

SHA1
54ccf4ed92c7ad7a68dcc8e94676582600f30227

SHA256
ffca736eac5ab3ffb307b7e2dfe079bd255fb8f189dd2197167dba1d8133b55f

SHA512
19b122b4812e98eca99fa3c4b9c55321469ddee191ce7b9ca8e7d2576a2396c1a52b57a207a937db4b78034c6116875723370c1690b249e54b38d1602b2cde29

Download Submit
C:\Users\Admin\AppData\Local\Temp\dControl.ini

Filesize
2KB

MD5
57be10b06dc5c309d37d2813a4dd02a7

SHA1
0612d80c2c4f2c0a3e66090af313ad1391717738

SHA256
9ce0f6b25cb41c025172c001ea02a6538545e63582d21943118fd7dcb56bad27

SHA512
27310c080c0ed37bdfd5a6803d4d2f51b8549cfbc73980ce1bb061bb05fabe30a817e0f7ad3bb5618aa66d76c9e508c05dbc569202894d416e9c2f3bfc4c6476

Download Submit
C:\Windows\Temp\3r0n2d8y.tmp

Filesize
37KB

MD5
e00dcc76e4dcd90994587375125de04b

SHA1
6677d2d6bd096ec1c0a12349540b636088da0e34

SHA256
c8709f5a8b971d136e2273d66e65449791ca8eba1f47dd767733ea52ee635447

SHA512
8df7bc46ef0b2e2d4da6d8f31b102ff4813c6544cb751eb700b79fa0fae780814551b58ec8d19ff29cbf8547709add7eef637a52a217714d1a18b450f6755ec8

Download Submit
C:\Windows\Temp\3r0n2d8y.tmp

Filesize
37KB

MD5
f156a4a8ffd8c440348d52ef8498231c

SHA1
4d2f5e731a0cc9155220b560eb6560f24b623032

SHA256
7c3ca3161b9061c9b1ff70f401d9f02b2d01267bc76cbfcbc397a5aec60d4842

SHA512
48f3c273f072a8c3c73a1b835ed320a6b8962c2f8b5037a3b6c1bea5431b17d9c03e8d771cc205bbc067975c78307f2306c55dbc4c72e0a7c15c6b17b3afa170

Download Submit
C:\Windows\Temp\3r0n2d8y.tmp

Filesize
37KB

MD5
3bc9acd9c4b8384fb7ce6c08db87df6d

SHA1
936c93e3a01d5ae30d05711a97bbf3dfa5e0921f

SHA256
a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79

SHA512
f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375

Download Submit
C:\Windows\Temp\aut89D1.tmp

Filesize
14KB

MD5
9d5a0ef18cc4bb492930582064c5330f

SHA1
2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8

SHA256
8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3

SHA512
1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4

Download Submit
C:\Windows\Temp\aut89D2.tmp

Filesize
12KB

MD5
efe44d9f6e4426a05e39f99ad407d3e7

SHA1
637c531222ee6a56780a7fdcd2b5078467b6e036

SHA256
5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366

SHA512
8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63

Download Submit
C:\Windows\Temp\aut89E3.tmp

Filesize
7KB

MD5
ecffd3e81c5f2e3c62bcdc122442b5f2

SHA1
d41567acbbb0107361c6ee1715fe41b416663f40

SHA256
9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5

SHA512
7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76

Download Submit
memory/2036-335-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-138-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-391-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-242-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-293-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-241-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-240-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-239-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-367-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-366-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-336-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-346-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-347-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2036-357-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2984-0-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2984-23-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3028-22-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3028-45-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download