mercurialgrabber | a74dac946b8d97e1d4e193d64aac8781eb32039412037a195aa10b40a19dc441

Analysis

max time kernel
597s
max time network
603s
platform
windows10-2004_x64
resource
win10v2004-20240709-es
resource tags

arch:x64arch:x86image:win10v2004-20240709-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
18-07-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

S0.KvRIxPT.exe
Size

42KB
MD5

858cbb9092153a7097a7da5e4a2195f9
SHA1

4cf6fe6d834168e18430ff8632265fd93e8c9bcf
SHA256

a74dac946b8d97e1d4e193d64aac8781eb32039412037a195aa10b40a19dc441
SHA512

1d5795d7931b02c7cc7d17b81d52bce17da85dd03d81ac5221b8eccda0bda0fe9052925037ea44cd64a4c3fce5ab648dc2f17f784f8261ed90f10c32b1f9a02b
SSDEEP

768:XgtO5EYH//4MmuZqLHSTjCKZKfgm3Ehhx:JEaDyLHSTWF7Erx

Score

10^/10

mercurialgrabber spyware stealer

Malware Config

Extracted

Family

mercurialgrabber

https://discord.com/api/webhooks/1014925257104162816/i_FgV0Vzo9Zj1gKs2wPCtFL9nQzLwfkh1frAZ_EO2HgDoESbbCIxJZtcdGID1SDoDkRZ

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
27	discord.com
28	discord.com
32	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip4.seeip.org
24	ip-api.com
1	ip4.seeip.org

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	S0.KvRIxPT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	S0.KvRIxPT.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31119650"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31119650"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051c0b768fca2ba44bd953be6973682e300000000020000000000106600000001000020000000bbba3aec68a7b44a8f11dafe87d608b8daaa03452eaeeb289d594ea139d21619000000000e8000000002000020000000f72c73f26618d0fb7d4a0ca37e10cc224db3746170857f7ffb598fef9ba3e63e2000000039bf737ed1da8b3e94b0f8ec2f3b2a146420db29d331021d039d63d0587bb6a0400000005978e0f3bd8a2414ed15287807130d3e5e9248729e7d9781184bfa0853e0605bfbbd505ee1820da0d4a475b29b5a6c4fdadde2a88efe604a7a2c16775d41dda6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8119D078-4515-11EF-8957-CE339AE42EBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1075475622d9da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051c0b768fca2ba44bd953be6973682e300000000020000000000106600000001000020000000fcb930ad220790a8e290d34cb32dcbd3449259391ae7dc8327dc078d96b0d66e000000000e800000000200002000000080ec71633a456e2d149a48418770c560551f460f176bd78a2763880922ac025620000000be0515e3783dcb7e4b1408dbe1e1e68477f72be0461458e201e44253d27ae4ca40000000a25f5483aa1b0be704d76e991e5ca5f1821e59e98e269e7ec933ccc968ad2ae89725f944775b8c4b38703bd74a95b8f4fd6762dc7c43b5c6794eaae6904e5b99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1433407653"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1433417209"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2049405622d9da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1705699165-553239100-4129523827-1000\{84CAA893-311C-47E2-B30E-68F34855EC23}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
2020	msedge.exe
2020	msedge.exe
1712	msedge.exe
1712	msedge.exe
5708	identity_helper.exe
5708	identity_helper.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	S0.KvRIxPT.exe
Token: 33	5144	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5144	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2136	iexplore.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
4872	IEXPLORE.EXE
4872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 4872	2136	iexplore.exe	101
PID 2136 wrote to memory of 4872	2136	iexplore.exe	101
PID 2136 wrote to memory of 4872	2136	iexplore.exe	101
PID 2020 wrote to memory of 2792	2020	msedge.exe	104
PID 2020 wrote to memory of 2792	2020	msedge.exe	104
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 3336	2020	msedge.exe	107
PID 2020 wrote to memory of 908	2020	msedge.exe	108
PID 2020 wrote to memory of 908	2020	msedge.exe	108
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109
PID 2020 wrote to memory of 3556	2020	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\S0.KvRIxPT.exe
"C:\Users\Admin\AppData\Local\Temp\S0.KvRIxPT.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ResizeUpdate.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x98,0x12c,0x7ffde87746f8,0x7ffde8774708,0x7ffde8774718
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6225271606606130875,8167833106919833518,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:5232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
16KB

MD5
48c80c7c28b5b00a8b4ff94a22b72fe3

SHA1
d57303c2ad2fd5cedc5cb20f264a6965a7819cee

SHA256
6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356

SHA512
c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
bc26c6658268215ffc020ea3b052336e

SHA1
b852c38f1765944023bb859e687db5bda0d62841

SHA256
dc441e8498e4fd5a57d1d6eda94de169fa156ba955c2511e44560b64445beafb

SHA512
d17aaf975b9751c2739f25706aec39d00d1cfefadb6615324cadcb04974c16f34ed1acd7c1d64a7c8759e8b84bdce5b6bfdeafe58a0eba460f65cefa14b91869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ed0f0a59ca8d9cb219cfe933464aff6e

SHA1
a5eeb40691520f05e3895e731cd5fc75b64e2725

SHA256
16745f78c8e80e8dd7accc9bcf7885d0ac5db229ea78cb6754945008896cd747

SHA512
e88eadeb8909e788c1fc342b778722d3f151c31d51d002ef36e0272cd879db653ee47192d74fadabb3937bcdca91e86f56a8a9181c9b264f8b92988b22e4080a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cd056ff7647166298528287a08599a13

SHA1
ba393d507b1c5f060a6e2ae7e973123bc2aab07e

SHA256
a29fb7201789da49dc5ca4c845df6841473d0ba001881e42e3b5f46e11afe56c

SHA512
936716ebdd4e25d0bbd70eec2fa787343be887f0d8c871c60ba889222a073be799b33de021088c0c32358584d8670f43471efa3cec318c4b81009275d02ff9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03c24912c5f551f69f4234bce8b08afd

SHA1
0bcddb1322b3689733dbe93fe8c179899da80cf9

SHA256
6c008de215fa566b576f495afac47647c7432a97fbb70d0596915ad473ea19ed

SHA512
4cfc265a3437ca45687b9b0d080d6797cb0031e2a9b0ae56354b855dab704b7d7ffcb1a50f04ae12501964d12e0f45495b9ccc3eee89d89d8eefcccf43fa47a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
03d89f71d7e53b44558cfb11b78ff6c4

SHA1
116d4ba9a2d5e9ebd576bb61126a43adc5fae087

SHA256
a186dd47cf28a1bec78eff5adb78ff0e4271c1fa727694b3384ad128450f3dda

SHA512
c57a9eb154428002babd4b8cc6699887e930cc30f5e4d6addfb3840047f76399106aeb6878df9d0475fe2046db5c229d1377af1125cc279f57e39c6acac73bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
162280b2eb4e23115e57bc4fe1609795

SHA1
c00cfc3d057067a731d0b9f973f87b699a2b75f8

SHA256
1f1dfe6c2a6a4484f199adbaf511f4fb2d1b2aed0d42d1c040d0386bdda2b09e

SHA512
bee851c78e68a18c072252fcfad9f4799461d61d5bbe9395ce9b9c9d1b28126a364315d93e1c80bb35d23f47d0486ff67d6fd7914ab0fcc92099d68bb1114c35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0936c4687695d9ed9e9efb7f959f6be5

SHA1
c7782efab0454b480c44ed9829f97191c965cfba

SHA256
16df8703c29d6d85c9b273169e9c545042a9fa456c0c7ccb566d623ba22ac93d

SHA512
31ff542ce7ad918cb16829e5973cf51d740d478da8b98a2cbe94d7fcc697a806b2681bb58c5acfa05f3a67a2d44dc1e2644f62175f7e844d51bc7bc9d70d91bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
4KB

MD5
3d3e7582c3fbc57bedb464a3aaa75ad2

SHA1
87037a508c197092b8b74ef0f91a3e67b15e305a

SHA256
5b8e5999cd601b738a8ce188d7767fb2d886e2bcb0ffd7cc1211ca412e2f09f1

SHA512
254f16a39c54d7da0b1e251f8223bf72c0038588d4b64adb378d159ac5824eb02dc7672fcbb451093dd29a45a8c63d62859f21bb0c6455d1ffc2089646a4ddfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
2KB

MD5
bc4980d38c8ed1f1643a4a3de24f098a

SHA1
9ecaa6803031d17924d6c6ae14916504a68213ff

SHA256
58f0e4779299704fea2855ab2d6825a702ac677ea57f80334ae5edc9a906a3b7

SHA512
a535c0630caddaf7c5c07cf2a56b2edbf0a1581fc1755e6efaab3febc0b5cc2d24aaedfb7919ab1f7f82e24318eee811e88fc02ac549c06c49775f8749c4970f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

Filesize
3KB

MD5
f3b79ee0f45abec8c4fa5c239f83aa1d

SHA1
bb825057b8926a57781c01921fda2555e30239d2

SHA256
d7e54cd46d1ab65a298d235ccc9736aff88997304239624af17b07be861b1d18

SHA512
b0fddceb5806a68ca01c5e90ac0cdcc622c3d8fb1d11a3f9a5991000ec99c4efbb79275442551c8d0e52b11443c3b6d4916e59917841be4c82036b6361602781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
d4176659c187da9204f3d69338802202

SHA1
c16f7acb98f053b244d3ce504a858325c6605c5b

SHA256
9225f6c14d22a0eddc7cd686c08bc8b8325d21c5a5e91982d2df2f1fa7d24221

SHA512
85ae875b13032b3259779e3445e5ce953f7b3697381fef890f2f705cf69a5827a663e49f4d8a46f4bc35d716a710dda909f7b7523d7337ffa62f0d89e8d30568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58da00.TMP

Filesize
48B

MD5
fd85ab89426f5499366d53812e0b95e4

SHA1
a108d324df98757637cca1626f082c5ff2574be1

SHA256
661998e6bb52697bbe72cc42db0997fe06d16f7fab90a5e43421d193a12608f3

SHA512
4dd3e0aad95fea84d3e9c86fe309c1f7601f8c341f04cffc3c26b69d7924b3e8c8572ca5eebc31da44cba8794d25ea5bf073ff86a64e1b0d88358d505c90da31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
01fb8bd78760323407e27bcccc079737

SHA1
94baade6469179f2e72ba563198067d336985e56

SHA256
576667bcc88cbb841efc29ad0f05a7c7ff5bcd6d6c7ac59430527009874ef37d

SHA512
c030f4cdd803098b220a71739ee5ad84aee4fbf80e3d3c6331dce95edeef8bd95f66a62c7083356bf51dca250ab27c125ab76a451ede61ed3d78c9f60b1d3043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
182207ced8882e0afddd016b697c277a

SHA1
520b802d8d9ca0c11af4603c5fcf498677935398

SHA256
c121d0c3aa4119b4322450dae0c8b28717d76f4f3f8fc9f09da76e201378ae19

SHA512
3ffaac038cf9cba7ecd653a3841e3e86c55e763f25227871a3938e4b3cc0668b8955d367867206dee187f6c37f60bfff8cad07778c4604deae5f889747f42c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d9f99c5f3b8455ae2796cfc66ce4381d

SHA1
3593ea6fa92337c9eec43398c9d7d4fa1d482dd5

SHA256
3c17b9683673a6e84743f077a020ae87274c9a3ea5ad3fd18a5e1cb3a4e4d921

SHA512
8e9f2abe7f8721dedac2340ff84a2be66798e0e4ef19397dd829bd933e8dd06ef5c5b27bda22dab2a0b1b7f9104a60c991e227d3dbf737439bf38911fc9ea200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c3495a1337abd59d01167126d68eb198

SHA1
24395faa55407e53099f7424b3907699831b4677

SHA256
8bf607b0c8b0c546a7f8a020e0a40c7f58ef7ad2fc4bf074f63145825e08576a

SHA512
552641c81df414c9da545d014b60ba2da460c998cbde5d5a112edcd6d023ab62761495b391f608ed9c6175f14b22856ea1ffa7af9d8994d8bc6e0551a7324b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4f58c5b2f20d57a24d3cee70935a39fb

SHA1
9b20ae83ff3e3f9e181317e140a2e360bc5f2d59

SHA256
3e9e94f656d8760af235534dd7f3f21d79a2ce8679ba1cb0ec0bd8c34c1877a1

SHA512
ef0181079eb10a7a7ae2d6d5927dc84a76c233b26439712feeca177ecc93f19dbf8ea2371ab26f17432bbed0e68934bca8bed183155b69e68484e8e6e7ca8372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
838418c43877612c981f703ff7c88981

SHA1
f34a8b6e5d52fc90d47699e0c672967babd9d89e

SHA256
ea64289e384e661125efa4d73608a77ec504abef11668abea677e2af42f3bdf5

SHA512
520d9f1a578b17d1a01ddf518d928592af85da405dc2ff7433ff9bbfb2e3346b40c1483595ac4f36d815ff606379608407aa33838537abb8ed4344fa4f994d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b7b674eef32bc3ca8918ccaacaba5efd

SHA1
e7281fe5b8bacd7abea6b12701f3c099da5b6683

SHA256
cb5056824b08e4ce3aa5f3ee335ea8717a76e7084b0ba38130093e57c84cd30e

SHA512
33782235fa2838b595b99af3958eacaed97b0ab98b523bb190c105197a207e773713852952d2de0668e385eac71fdea6f91666fcd6760843aa662533620c5d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d6f2.TMP

Filesize
1KB

MD5
d3d43cebbe2b913c1392ddd885ee72dc

SHA1
f81c6482f52099f1ee990bccf3224c89d782b1aa

SHA256
53f5b80578b4ed8089359009385761411c5fd43a364eb2a88643cfccdef0fc69

SHA512
a7fb64e284fa238381a0a0ded6b10c00eca16fa64e33ddfbc2b8dd34107445ccf35c2aa482342654c47125f798680a532a07936b8fd5bf153c3b5181ea4fb5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be8d3e7c-0c0e-4a88-910b-68675df6a454.tmp

Filesize
3KB

MD5
e8e84662fb25ba64d9f15cb99482ef27

SHA1
3cdb041b1cc94ff4427c9ecb4c6f0f20c1422f12

SHA256
e1470b7e5353ff1b8f0897d24a8b8742dcd5d36cbfd290489a34215701d453ec

SHA512
63cb60b153be9670210be40d421cbfe82b6a578ac96d4a20efea362ca94b1cb4be814637f2a014088325d7b8c6d213aacd9d58feb6af1de202074275a08df1fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db2285b1-ed00-458a-a243-d093cb8b8228.tmp

Filesize
3KB

MD5
978fb7381958b218d8d58e0b4827fef6

SHA1
325e3f3eb9eb1a88b5a8f4f85b04688994e2895f

SHA256
ae6ddc783285830a91b9d253ccde0d0302b2df1162ef8417874e4810d318d81f

SHA512
019f6180a63a1cca18ef98bd81355905996512b5aa0907f5ae01279b4de82631dce66dbf2d3a1f333d74111ad4e859494f4162556cd9806b65fd47cfc93752ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba7001cf8a935ff6e9b0acaaa14f146c

SHA1
6c77fe9b8506a61b5559e326345a824afe98508b

SHA256
ba3b9881fca4953e67e026e58cef933565447c29dcdeba803a60b649a12aabb4

SHA512
7762e06c409f9f71a3085f2207f01525bbf68df8a25e8544204b3facf106e2ed39d950a8a52907301837781b922a420fc813d15d2c9190b3b911304e336c5d97

Download Submit
memory/3856-8-0x00007FFDE84A0000-0x00007FFDE8F61000-memory.dmp

Filesize
10.8MB

Download
memory/3856-0-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/3856-4-0x000000001B880000-0x000000001B8C0000-memory.dmp

Filesize
256KB

Download
memory/3856-3-0x000000001DB40000-0x000000001DC42000-memory.dmp

Filesize
1.0MB

Download
memory/3856-2-0x00007FFDE84A0000-0x00007FFDE8F61000-memory.dmp

Filesize
10.8MB

Download
memory/3856-1-0x00007FFDE84A3000-0x00007FFDE84A5000-memory.dmp

Filesize
8KB

Download