dfe389ef2ea61be558cc77871bf650ba3dca2a0582a735309e2bb64d6ca79dde

Resubmissions

22-07-2024 00:45

240722-a3893sshlh 7

22-07-2024 00:41

240722-a1xhhasgnb 7

Analysis

max time kernel
210s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mc-token.pyc
Size

925B
MD5

5421b6392daad0ab575dbbec871577b4
SHA1

6698c220d19698c82f76ae3fa216920090ad4da0
SHA256

c608a5174ee93c59131fd250e7ea60dcd5b10adb376ebc683e06aef80461e42d
SHA512

32bcb7c1fc382aec0cb21454485c35f48ce5a2dba6a00126eaad5ac6ad204074ee3e50150e69396347cf5fd1b0cbd874ea809826c19e9c2a54722c312fc733ff

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133660825701819815"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	cmd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\pyc_auto_file\shell\edit	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5a00310000000000f6583205100053797374656d33320000420009000400efbe874f7748f65832052e000000b90c0000000001000000000000000000000000000000e65c5700530079007300740065006d0033003200000018000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-384068567-2943195810-3631207890-1000\{0E9598F9-56DF-4417-9BDB-31C2AEEA3548}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\.pyc	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5600310000000000e9588673100057696e646f777300400009000400efbe874f7748f65832052e00000000060000000001000000000000000000000000000000f894e300570069006e0064006f0077007300000016000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\pyc_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2080	chrome.exe
2080	chrome.exe
4912	msedge.exe
4912	msedge.exe
1864	msedge.exe
1864	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
5352	msedge.exe
5352	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1832	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeDebugPrivilege	184	firefox.exe
Token: SeDebugPrivilege	184	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
184	firefox.exe
184	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe
184	firefox.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
1832	OpenWith.exe
3640	NOTEPAD.EXE
184	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3640	1832	OpenWith.exe	100
PID 1832 wrote to memory of 3640	1832	OpenWith.exe	100
PID 2080 wrote to memory of 1176	2080	chrome.exe	111
PID 2080 wrote to memory of 1176	2080	chrome.exe	111
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 1992	2080	chrome.exe	112
PID 2080 wrote to memory of 4812	2080	chrome.exe	113
PID 2080 wrote to memory of 4812	2080	chrome.exe	113
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114
PID 2080 wrote to memory of 1452	2080	chrome.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mc-token.pyc
1⤵
- Modifies registry class
PID:1800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\mc-token.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff7ec4cc40,0x7fff7ec4cc4c,0x7fff7ec4cc58
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2200,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4620,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4756,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4956,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5260,i,11325364066287894952,6838857727636431477,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3016

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff8ffb46f8,0x7fff8ffb4708,0x7fff8ffb4718
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12049227908691107463,18352875631824746122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d263b6a7-effb-46d4-93c4-e07dd5f96e08} 184 "\\.\pipe\gecko-crash-server-pipe.184" gpu
    3⤵
    PID:5400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 25789 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0ea285a-c57f-4bb5-a1db-a09b9df1796d} 184 "\\.\pipe\gecko-crash-server-pipe.184" socket
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2920 -childID 1 -isForBrowser -prefsHandle 2764 -prefMapHandle 2932 -prefsLen 25930 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f9be5a4-ebcf-431f-a807-2d06e59f7c45} 184 "\\.\pipe\gecko-crash-server-pipe.184" tab
    3⤵
    PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4028 -childID 2 -isForBrowser -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0f7837e-518e-4566-a565-9fa187516fd9} 184 "\\.\pipe\gecko-crash-server-pipe.184" tab
    3⤵
    PID:3100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4676 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4724 -prefMapHandle 4796 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a771952e-d3b4-43e2-8f15-a9d123735554} 184 "\\.\pipe\gecko-crash-server-pipe.184" utility
    3⤵
    - Checks processor information in registry
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5308 -childID 3 -isForBrowser -prefsHandle 5300 -prefMapHandle 5248 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd9d7595-fb03-42fd-a7d0-0bf96d445f81} 184 "\\.\pipe\gecko-crash-server-pipe.184" tab
    3⤵
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 4 -isForBrowser -prefsHandle 5464 -prefMapHandle 5296 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8595e79-fc71-4f0e-8f92-7c5229c72834} 184 "\\.\pipe\gecko-crash-server-pipe.184" tab
    3⤵
    PID:5688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 5 -isForBrowser -prefsHandle 5652 -prefMapHandle 5656 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cf2234d-544d-4d09-a5cc-eab9172545bf} 184 "\\.\pipe\gecko-crash-server-pipe.184" tab
    3⤵
    PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4076 -childID 6 -isForBrowser -prefsHandle 4536 -prefMapHandle 4532 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d86c5db-e086-4776-a8a1-a1348b5032d8} 184 "\\.\pipe\gecko-crash-server-pipe.184" tab
    3⤵
    PID:5816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f9527087a0b6116300c0508030ce12af

SHA1
92f8610971eeb89b9c2b659cb2805fb7fed91072

SHA256
0355c83cfe5f0888d56f60ea555fe69314446855a4f3f10c80260639aa3e2006

SHA512
f000a930c3a225db0c08ab73e1c39dc801e54a1c59a63a8d1a3b1419af6e1ba41e0e5cec787ee4ba20f076f79e51536b42900a0151c4413491a2d7460b736076

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6436402166f4e7674186ac1d179df5ec

SHA1
0036a31a4243054ef4da8a5df7d3c91633ff7582

SHA256
1e4a1adc7bc8da185d24071a8615eb13aa314dc77a98a9e340b1cf032fb9640b

SHA512
c808b090f576a6557e41307a1b4c72e6c6c01d49136739d54f894c83b2a780b8d4b383ed44fdcbc8caf955ea28ef334e1dc82c0e436f4dfbe9db93fcdbc6bf8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5b4c8fd8599184861d1881f66e536f43

SHA1
e73ca1ba00154574748245262d7ff252b3cc5e46

SHA256
fe89d10560a5a3f237002bd1182738aa1aab6d1837fb560333f189f7575dc7fd

SHA512
d640505ab5af766ca7744d86911d3512d0b9ca55c8e6fabfd5e5a6559d8463c055a6bff904e16181a8cf1c95236f8b4413cab9eac70b6892ceac144a93be0c35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e1fca8b6-8f2f-446c-bdb7-6f697803682f.tmp

Filesize
2KB

MD5
96f95a2f1c81a56f27afdbd941a3c837

SHA1
a0c1cee240badaf29cb840421bc620eab75ef42c

SHA256
634852f5336768610d234dd7b7c851d8d5661c7c09a242b556f5b6f9c775e880

SHA512
a5500028195cb34cde741226213eee54fcfface2d350bd58220582bc49077fd03f5fcde15eef81ff83c9d000dacbd8ec34cddf1fe11bc008ee13097e4195eec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2f011f9154f0e8d626872d1d8b9cb4d9

SHA1
1d267defffd56430325dae360d706fa443489499

SHA256
697f0f161be9a5e0177646db269965f7f9dbc951a87f705347bbcfe27fe983c8

SHA512
27cd23ab4df6b0b7ce2b1939bc65364b7aab802252bb07a8539ed9832516a48e94c050fae2352e08c98cef824b63ee35adbb559d1c7f6a6a4b0c0d7350a105ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
92482decf510e6cdf3535787d45a2ce5

SHA1
9cca72c77715fe60e430d341bac223208f005ca9

SHA256
ef84a28647e4b93f0af8eaf8d951322931ac24fa2fa1964889eeff15c83b21f6

SHA512
1b53618dba704d3eff90f2d79e482b484373101462f8b542aced79aa7905ffc975840b32d6539856a47ebba12398c642249ec92910a417ef78ffa514919a24b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
0ef05ed20bc92791281da2fa7705e5a7

SHA1
5d64756b1d9eac6a361e81eb8dd747b7107d1c58

SHA256
07d04a8f23a16ef5e8fff9bba39446dd941f8d69450dd23f6d8331263295397e

SHA512
b192690c6010082141b4e9b2573abd3582bd73a9c25dc0ca5738b70c2bc77b68a866520228846ff281bfd6b3b2928fb3c4b11c6c2d7498ed75aa16ae4b73997c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
185KB

MD5
6cf591aa82901196ecdd5ae532e72437

SHA1
e0fcedb96a9d66ac4e071fdd2e65d71260dce173

SHA256
25617030e39525ba7074ccdf7d5eafdc608ba144bc9b96ddef0848cad343868a

SHA512
e1ce2ff8cdf25cf7a8fdd410a8aae857047c9fae728e48173077cff9eafb8ef5acef418247c5fe231e9defa3b845ed1b59d7a962cf9cf00cfb3fecb840f9ad55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
185KB

MD5
7a8b744141e4c31a6b40ffc58a780608

SHA1
01d78e2cffa622726621bfffd135963cfb6ad89a

SHA256
b3f49a4ee5d95401790e938393b8cba6e5a21b7250547c6740e4a3bf2f5d8b7e

SHA512
463cecebf68b95cdc95af6f9ad91bfd7b0cd5f2962cf76538fb8c04455826b26d0f061c89217aba583d31ad88caef8b73c28c964f193c3c66277b59966abf502

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\809a0728-d386-4a8b-8608-05cd5e35d7a4.tmp

Filesize
11KB

MD5
b01c89c32c1738b05de824446bffc53c

SHA1
5f200213e8fea70a77b6a33287cbb816132aeb88

SHA256
defa3bad680d18adb311127df05a07f159fb3ca5e87e58a25cffbaf942393674

SHA512
062a41bf57cb1eaa16d68e4401ce3d8478cc5b65f19f6191dd48de59ccc6a66f58e50fd99275741f8d7e3c32fb9e1bd00322bed76a9be587eb7b57d72fae0113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
78b45f66500680832e342e6fb8f0c7a0

SHA1
457528aace12ab0b6487a490d7b8a6adb13dc8f0

SHA256
5cb9b5d3fb0be382aa00936369c7589c938a438c3942c9883072dee465458c00

SHA512
6c1aad5408b7c02a828596f5030fdd310b78b79dffdf3b3dd997aa26802b55026bc18d7fff44a0e3fadef8087b43964262a9894fd4fc06de1b229bbc6d3b2b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
931d16be2adb03f2d5df4d249405d6e6

SHA1
7b7076fb55367b6c0b34667b54540aa722e2f55f

SHA256
b6aa0f7290e59637a70586303507208aca637b63f77b5ce1795dfe9b6a248ff3

SHA512
41d44eafc7ade079fc52553bc792dace0c3ed6ee0c30430b876b159868010b8676c5302790d49bed75fa7daa158d4285e236a4be3d13f51ff244c68ca6a479ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
51KB

MD5
5a7091bb1c4982bde3f9d3901587c11a

SHA1
2c990a8d38797d5dbcb8322219fc9d828aeeff29

SHA256
41c8fb1312e45d8c38f20cce6e9b922f39ad22728366566aa135bfca41e8e725

SHA512
1a8628e84210a47deb5d626d0f3c3ae39113e72a71df7ef90c6bcf857cff336248bc2a07a3b9be4cc66bf90587636dd34213eab52ac27d273c74c6005b3f7e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
42KB

MD5
c18ac29cb1e1afeda67dcee7b8fa497f

SHA1
2e2fca9619705de092131991d0129594aea866e2

SHA256
f5f3e3e947878d45fefe0b0a2f895a13010d3121eba5e9d07bd1d79e01ddc3a0

SHA512
5dcae0c20e115715b382792e9b6293e644d44b644dad8a2960a9815beca0ba1ff2697118d282580c473643f97442b61380bd59a5ff92eb50bad11e96dc81a48c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
82KB

MD5
9fd10add62c60e8fc5f6435a4ad86767

SHA1
f452151f876f71abd59ba2a6df4d11f870d71289

SHA256
d6c652738008bc6b0f647d5c30cc78d7fe10ddd32e4537ebd5f972fd0646a2e6

SHA512
7e5dc3ed1e778603f1ccb42023ee4400f6ab08db4b40f39f0d5ebac2a81f9dec1ee1c45fd0454ea080c3543a35ed1f635819c761cc77ad060267bf6560b75ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
70KB

MD5
732cb603c3fc5a074877328f9f1db84f

SHA1
b414e7a4b1a5d4fbbba59de845ade9f3e7041798

SHA256
86ba7796c633602c3e93a50f7f6c4ae45de4af5e00c34e4de87a2b85df3447d4

SHA512
6c082a0c83fa93c758f0ac5c4a2bf4d91f064b0c5525401b4f79814e8a8a42c6031755a8dd7216cccbb770bcbae19615c55d123fa79a48f35509a9ea1a3d799d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
107KB

MD5
0db17cfed7d08887cbdff247f84f1f68

SHA1
e2cacb517239cc57e08055c7c6e9a013ac42dc74

SHA256
09c05bb04e45e0eb74e846004ea789096d14c37fdc0280dbad4fe6127030562d

SHA512
67759c13303de2f9d948aa87faa7a847d01aa03d6c9f7b066b91da80d8d03be26b2a246ffb43eb19fb443e671a8318221d8c02bd8f265fd5c7d28d888edf896c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
64KB

MD5
a950adf4e8ddc93b450270814d5b70fc

SHA1
52caeed15a4a63c2ec56924a946b3d00cc525a73

SHA256
ad2b3396f3574f6b6433ee6a71578d09399d2a8e4f98d918728064f49c548a1a

SHA512
8ec579dc5808c221487c3b036baeab5853371af1f0b84795e77b3600f977043bae1759ae7ba84e020dc3c51bb96b6e8714f02ff7c3f92e912df1c225268d8f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
54KB

MD5
ca025d2d8ae4b3dc51e058b782590501

SHA1
eba33b512ac06ec853250fd52a43f49af25de701

SHA256
be1572389dbe49a82429e9db9854bf32884bbca0825031cb1d14d84f677fb518

SHA512
45befeb37605f646801ce73e483ed461c808f7c15ef2ce5e6bfbbac9e61cd76e614602ebcf6c98a8ae09b3c28c7c2036975c26200837828705b13596978a3985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4585e247b17248b3_0

Filesize
19KB

MD5
8d7e25d768bb015d04b9abcca50c1347

SHA1
4d2141b49718a99a8ecad05368e9125cf49ab32d

SHA256
a865703f5510e6d18f25b85dc9980e13c83684c6032c7d8c0faaef55faab1b71

SHA512
a424f85fa2ccf7cb88045ec05421c0a203de01db93167a84aaa8762bb4c623b044f8bb9fc06a135c87f7b01b08c8cae898f6f598d62a5d74122d7ab05ceeb7a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a78824b3d2646c0f1487e41225268e23

SHA1
141a8765bb11c740b5beac7b94668d55719f10f9

SHA256
dc33572fcaa657834acec0d52f68fa87359849378ff8c597b458ad509fa3bf5b

SHA512
d9f635ecdb00944caf816f08ca1c9f20f6e7de8b509a05969c23aa2a2c11f3eb213cca55104b54ae718621cd7d2b2c4d8fbd5479dbadd7740d152ec6b200b0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.mediafire.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f15644987dfc3a4c85ffdaeddf11e570

SHA1
b9e1c8293d6ea9a497e6014bb80314ba0d2cd58d

SHA256
9674fb3609199f9d79c5dcbd14a49e8c2adb5b903809aa28c1d28d4d63797bca

SHA512
8defdb4518f44d96c80777b50b9ddecb259d97f194aa547d7ac4be67ce643979d5fda59654f6f4845407f3a8d10cd2397f73713339b2ddf69bfe7f55dd3ab6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9352bb0caf9ba6f10d4a0aaf14e2d595

SHA1
5c430404c5e20be17fc53c4678b72c8f0e435d88

SHA256
55aaea4c4bbfdff343fdeef7b8ce5e76e18ac4f01cc5c9a9a180cddd0fd5b310

SHA512
97dc53aed12b6e8184032039a34e25d1675668ad0bbd7927f0311d85d59afbf2e9480ff65b37919fc7437c5c55b139666d5248cb77efab1e0ac23c1af6c0a271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce39b95ead2a68acc7ddeb98cdd0d884

SHA1
407541811d2a530d3befd73ca08dce270a9a1716

SHA256
e1b2bf786fb53efb9046d3e76d7b5cef85ecf78da9d8c8d3d009eeabd4d902bf

SHA512
1fe80757c267bf6a839600dd588da5026be098c33129b3e0a7c81d2c6a9d0712e46eef3d16140a3224864b9ab7bf973d74ea3976ee1c206a57daa7c5d6f6f071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f0af730296981f92c8fee89b407431d4

SHA1
1db9b39542ccc04d8b991a482c1145e5ce1875c7

SHA256
d808838259f805c6cf959571606a8a9cbaaa3e744c88594b5a17ebfecadb1158

SHA512
c0058f384af0731e0134601a634958b7d36b262c2cf5021e8588d47a328c400337e0e63dd2c884db95ca92c1bd37612a7ee25ac33990abe67c88637683c2f1a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
77d9274455dd810cc9d4d72d1cafbfd8

SHA1
2503b1bbd0d218abcee6cb2909faece499677667

SHA256
ddcb992101a8e24ec19ca35958ca7aef76b9d001873a3c8433a130ddcd465421

SHA512
e65885b0bcd5cf22469f020472cd4c6ba64e94ef89bc3a4af43d93bd668599f8f7c23a3d3a0a2c8718b2c71372c5216b53a3c61bb725bb71ebe5bf2587ba4e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0292287956d00f7e62cd6ccca793889c

SHA1
1e9ac4b0e4da262ca64def576220991e0f4e95f8

SHA256
cddb758af12a1e0c091a6f530dca60086d2e90ec6994d70f02244f37aeee31bc

SHA512
53a24ebdce44cf9e4cbaa82ce32b93de119af2e9cdbd2720c71486d0193b6c84fed387af42120c9bb05296d42b5fbaebbb8c4a1580b9e76166b2f4792df1d71b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e1432211b90dc96faa29d9e03a023e3e

SHA1
251cf12c8301e07fb0ae6457f83e91dd2c5a6b03

SHA256
c2da0dacfcc08ae1e11fb45695117ef110e7f97fcf1fa9e6166725c893beaf6c

SHA512
7a3971422fc5f559abb2c523f475ddb6fee58d933c596c9d02ad7da542fc72d4d76370f1c041523ecc30007b3734706ee5e2345ac3602977811a40ef554800ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9ca4652ff63974ef91cd7a7de51de975

SHA1
ba62119052917b9f728147a3eefeee3ea4fc54ac

SHA256
780034933d3a27334013b64676c7e86ff9837d230d6bf20acaa434e81bae5e01

SHA512
38facb8c33a1b54ab9090743b0938bc43aa6a3966812f4fd8f658666268175465ec7c2d47228966e7032db20a7e3284a53379bbfe94595e3c6b7ef0f6c358949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3b60becdc60f5bc06c11f0bc7303f954

SHA1
5bc780518f642efe146f1642630d791d9b0ae6e9

SHA256
cf2d631678134c3e5ae0ee7725830f574676956704412356ac168a6c71865587

SHA512
ddf75bfabafb77ac3e13dd5da897714ee472a54ba00d843a940404e24d647d14104126d6ab9a2a29a7961152ba768bf503f2f9f3f7cf1d46b19d50de062e08fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d07288e9880a99d7e86888ed2b02f759

SHA1
8352d34024f712ff07f54f8050d870a7843357e7

SHA256
38bc707948102493f32992162c4cd0bd5cc6041654ee0d3745c70bcbc7f7b8be

SHA512
82c450ac762eb3f7d8feb1b8325d6981f14ab33d6ccf9348eecd1da9c8cde0e198bae9138c5ce757ae929acf847550fff0018c5341b2c8d7b91bee39b8bc94ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
78bb1fba307ad901b6d8779fc6e36f64

SHA1
6e3424496276e721da84376d8aff43ff11b74216

SHA256
80b2ba94669e4221f7fa8763b5ac3088651713b6c041d40b2c18f647bf7e295b

SHA512
c7f3a8da6b1f7145341d3a2adec8a051b08dc169303d896f0b4077d89f382dda09acd853919c955ee81f7e6d5ea8b204c107a2cb4d56fea470e28536cbfadc50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
566c4da0fe7dd36cb61d1e033733c5d8

SHA1
a348fab38436c153d4d7757431d0b6737d82b89b

SHA256
471ee4d3faeb8df3892b1d1e9828c1ee42d6b56b48c1cb8498b3a3fc6b620fbc

SHA512
68ceb8173470d46c5067b3a107c99dbbab0941f1c479d778d5cfff97cca74feaa359e6137f8c6f96b24787b6f41efa19b42a12b26bf379d81b37a809c3171ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d30402fe6c0ee27ec8cb30448967999

SHA1
9b7d394459b83c111174fb51abdc27868d89d31b

SHA256
4b3e605927ea13748819da5b62243a71c58263c21b4448a492aa308b711ccbd6

SHA512
ada9851620186d5cf76696359e8b3e1740364506f42c78c4bc60377a9e81386b636de1ba4a73b3ee867f6202525921dfcf614ce903d009aea95874ca67757123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be955896bdee355e0eed412031e6a753

SHA1
25b8ed62c422750adff45b0676c7cbb69a2336d2

SHA256
36d769d4705c292e80614155c198ea344bfbfdd309c917a611d0d2ff0adb94bc

SHA512
065b33181bf1664d5f181cfc0f9bfda1d01f88e9f4a7db13021a95451077f53abd61bae6e456982c8f7fb020d7d5f891259685c16ebbc99e46317f0af80eca21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf71765413f3cea13d00ceb4d3c08a2a

SHA1
5002d73dcf021cc5161eaf7e8b465432eb9dbd08

SHA256
24dbe2cda0082bb4c4ba52c802114a66361c0243fe62bda3f73cf31de3508d79

SHA512
e49d1649a0aa61d2d9bfe1bfe3384020eb98039920e060408739c2dfb507a5304a4333ce7bae09cf4d95f49e26f406f0f7c5fc86ccbf013845f3864a0e54653e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594cbf.TMP

Filesize
538B

MD5
a00ff44a2b1dbb60a75c6565632c6b3a

SHA1
e1479a1a3a61e3ce0d4afafa2c5ccb8f33a04aa6

SHA256
8e0a53f439a6f9b4971f4b3c8f75ea13e63a3d2187f4174a66ddbb7cbc4fece3

SHA512
1d2f9703671dfdc2a045ad9dc46991386a14f566936de43381149830be3d6f51f8d8a79ce432a79e94255182ff05dfe4a5ae25813873240624b2c4141f4a451a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7baef58-650c-43e3-9afe-65fa2afa9f38.tmp

Filesize
6KB

MD5
80924f8cdc0aa5d9b027347376491ab0

SHA1
79fe70f1b75390820ee6ea648039b088cc066fa1

SHA256
32a52a0552e2323c364a5959fcbd267e7d52f170f695fed3a44c9bf4919387bc

SHA512
e8bb486889568a3b8ee3e99c456165eb614d13ce48431355d2f72588b977dcb2058424b4671497f6bfca6b10bb396362eb8f07cfa73d6ccb62b56aff426396b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b05b1c73fc8e85860b8b353c8c65604e

SHA1
51d1421a7788efa7196db0008aad6e5de1c051a8

SHA256
ee6ecd5634c4bbe68f0a328090a942228f2102bcef85f019c1f36f9b773a03cf

SHA512
a4f42d82d7ba3ff6fb368f7f3d2457a005e678b71ad78da8166613b13fa8b665b90ed07fee34c8bd7628c75802fc2cfa26c5e04f74304bc78b291d83b9e35299

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
69eb143dac6ca5f5cf98b2367db019ca

SHA1
37a1b182b3ad8138a82d37c17c1b9ecd333cbdf8

SHA256
c9ecbe24214b06a1b1b55467019fa254a54d549c18d28c5aa78d78c364bb198b

SHA512
c03b517bfa50a8a7907439afa7beafdd2b923e7b73b74c4b2d13ea96bf059b5719faec68ca707a367344cc6b21b51d7b05046d54cae7cba084cb711e064bb3f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
1b37a7e7764ec0e766ed7b6b42f74faa

SHA1
d21949e3932342015c72cc6da7842092bb1e13cb

SHA256
6c44f7f438009e72b6e12941ec0df40993531a7fc7b23518b127ae1bc1c33dc6

SHA512
a6a1c12695f15394cb9e2b13d43c3c13a91b51450013740d7ad761cba3720e9446d92f71ad8f80a2133a20eab4b6cb5c3f8f8f250c58c5e289e90a1deb18807f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin

Filesize
8KB

MD5
cbbbacc7835902b75ba6da0854629598

SHA1
63a8fdf683349ff7ae0ef3994476e36892969d15

SHA256
0bd658d33f02a1dcfbfcd889b0c5870bdacbbbcd161de0491d3f04ab6e0ff17f

SHA512
e8f04a4950c535b7ce10cc5ca980204e3b8381f29c757546f507bfa4c549b5a380868baf9295e2ab3cd25c440117a5d37ae78150315cb08eedae36b0665f7880

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
3c650c7b01398b59987bfd2814978ba7

SHA1
4355bdaa45f8722ab8a1f0ba1c65982307ae5005

SHA256
379e48a46eaaf0940b1c1379b22856ceba1249d7070c63636b0418eb4d57e099

SHA512
25e18a2da22ce313f047f8f4e457b47f8fd85f481f940a40a3be49c1d59fbd02b1c2c8ad9816ab3e7d44a73a459ad1ea5a8f8d445391881bfa3a8c01d14b77a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
b39bd858c065d154661abbed4354d5e8

SHA1
42cbe69b23b6a9ed515f0facb810d72edf3a2cbc

SHA256
621be0124199eb81fb6230d7f38665e5c542e65a7ac612e5c0dcb045ca8dabd0

SHA512
fe2e2fcbb8b53e9c91f6b4ed82704da8bc2bf9a484b2a665431cce0be2937b95566ab21f7fd3e374d33791adcccb19b1c18b67c1ed5bbe6bd62c5c5e0f389be4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\6796dd9d-5869-45f1-9550-1b8c3bb63ae3

Filesize
659B

MD5
39398be85952ce5a8c00518bd83d17a6

SHA1
acc63facadd717140a5c7e2b11d53e543554f67e

SHA256
1b0732f1b52e6878e7c205f30ca70cf285dd386d2842076c232b2f5dfc452995

SHA512
dca4b79a716d02bce91716c113cd750a4d13809b269c4caaed9d2b82c298f4365719f80104728e9c56a8e675454f0226660cfdc695edae285a588afe1dcf761e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\af9d3d24-d022-4f69-9513-b33ae7b004c3

Filesize
982B

MD5
ec89b3063cb9b24e9f501e84edb340cc

SHA1
7700727600fca2dc44f6eca89863835a61335b92

SHA256
9331a9c7076f38afdceb6e1e3687e5d86827b01a592d2802aea8aed4a8ee8622

SHA512
16755083eeb187bc0a5221510c6e838ab15af2f10b4cf2d786daef93d389e3f0447d8c296a5cda33e3257239e749c83bbd2fe8af7bfa0e397400f6f9eb8019a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js

Filesize
8KB

MD5
9471174ac08f72bffbc7e2ae593434a4

SHA1
54f17ee4370fc46020028ac6e81a8b0d5d573785

SHA256
08674c38d02638fe822ab55168ffc3d508138b54fe72a2febeb6492de27d1382

SHA512
2e1e1b9b16242534648e705239b7b3949bea901c9410eb1ffaaab136f9e3488e14c6fa23e0d3ad37422ea4a617debec2b3b980008342e60094b0f9a48bea39c8

Download Submit
C:\Users\Admin\Desktop\mc-token.pyc

Filesize
925B

MD5
49db8ff3de5cd1169ac5cbcb46d8f829

SHA1
131367637b500bfee5b6f465ec90e168ecbe35ce

SHA256
94236304a39f2f9cff53f6e7e5dac700e0f690aadc643ff58db28e947e03dee7

SHA512
033a80d9c670036252cd7383d0906efa0b17c19d3bc40b32f1ecc1fcb90ac5c384b293e5dfa63df59f5354cc2c70d8a3c37aed15a0ecd661fda2c747ec78d2ec

Download Submit