c547f9193b8fcb681dbb93968d54ac9912901097e1912ff7ad11c5a9ee13062c

Resubmissions

11-08-2024 08:57

240811-kwnd5ssgrq 8

11-08-2024 08:53

11-08-2024 08:47

11-08-2024 08:37

11-08-2024 08:32

11-08-2024 08:29

11-08-2024 08:26

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11-08-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ-Destructive.7z
Size

17KB
MD5

d91a65636b8d4b7437983e064e2580fa
SHA1

2bfaf387d22b7e9c1a54c35d8ab33fa84006ece3
SHA256

c547f9193b8fcb681dbb93968d54ac9912901097e1912ff7ad11c5a9ee13062c
SHA512

0175a90f980354b6f9a0fb66be6672c18c03a33fb547a0a16d159f18745f59fc5f4d9dae69dfd4d3bcffbc1bd3bbc73901000931dc3c12b70dde6e4e72a92f9f
SSDEEP

384:CxpNbARMGzvkdrUUAhybY4GfheFQb4M4ecf3iQ/FF87u20VoDWXeQT:Cxp6RLzMtUUVMsFQb4ycfiQ/o10XeQT

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
43	camo.githubusercontent.com
44	raw.githubusercontent.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-242286936-336880687-2152680090-1000\{FA5B858F-918E-4EE7-9738-A44284DD808C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\hosts-3.14.93.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
1412	msedge.exe
1412	msedge.exe
3212	identity_helper.exe
3212	identity_helper.exe
3120	msedge.exe
3120	msedge.exe
1344	msedge.exe
1344	msedge.exe
2304	msedge.exe
2304	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4360	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 3664	904	msedge.exe	95
PID 904 wrote to memory of 3664	904	msedge.exe	95
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1656	904	msedge.exe	96
PID 904 wrote to memory of 1412	904	msedge.exe	97
PID 904 wrote to memory of 1412	904	msedge.exe	97
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98
PID 904 wrote to memory of 5092	904	msedge.exe	98

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.7z
1⤵
- Modifies registry class
PID:4124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2200

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4516

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe44ee3cb8,0x7ffe44ee3cc8,0x7ffe44ee3cd8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,5530355589065767581,1491978818979881078,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004D8
1⤵
PID:3468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\528f8a92-2f22-4dd9-942c-5f2ce71f6e0f.tmp

Filesize
1KB

MD5
a2ccaee44f3dc16a0eb34f236fe7148e

SHA1
416a8903a6706ba889d76edc0b064d7d6e82724a

SHA256
bda833267ccf64954a5b7d4c461f302cf8d608eb50dac8fdb906bad10691e1b7

SHA512
75774f89c6efc13f52262810a1ed8f63340eab65652351a4e94c090cacb16b091ec6604670af4cdb1b628ba71f9a1a6a7dff8107b8e655dbec018f7ad8caf7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
a7ee007fb008c17e73216d0d69e254e8

SHA1
160d970e6a8271b0907c50268146a28b5918c05e

SHA256
414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346

SHA512
669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
9f8f80ca4d9435d66dd761fbb0753642

SHA1
5f187d02303fd9044b9e7c74e0c02fe8e6a646b7

SHA256
ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359

SHA512
9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
19KB

MD5
f5b631335f170065edf1b148e10b34d4

SHA1
ca34f82af577fec763ed38f0436d20f1cf766f62

SHA256
99be964ed51ca453ccfaa264a1ea9490da11e32b53765919172b6d3749a9f846

SHA512
c66791cbdc7c0d12e7295eb26eb583b26e03692c8986ab7d5dac0e6a561b8b68a8a9e33814121efc700ff6b472aa4f685162b0c75439b144f12286c9e28c7cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
17KB

MD5
109a8cceba33695698297e575e56bfad

SHA1
2b8c6dce1ccd21a6eea2dd9aef2a8a6bde389053

SHA256
dd82d9ac034f0a06524fc1d5ef884c29a7e4d586a1e7db66e339dc54fac3636d

SHA512
6d51ed30c45560838df921212370a0044640a8e3c0433922106225cb6fec8cc115ac6191c753da13def21c4e0db4deb5782fb7a75ada822ced1db7c7d13beaf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
23KB

MD5
de8c6574e9057e4b6ea7b9437db4b9d5

SHA1
265d520b6a04b434f5c3fc8c28debac183898db2

SHA256
51f281fe367854904b3db4b6f4cd70ccf90414335716482aceef382c536ae746

SHA512
cc8791772d03ee3f4b13654d2bd3354ab1ec28322ae3522187603bde00b1a5d940e99e62dda0fd3a7faf0ba9c3cd42425d0e64196f954bdb93c979f5e990e7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
23KB

MD5
bc715e42e60059c3ea36cd32bfb6ebc9

SHA1
b8961b23c29b9769100116ba0da44f13a24a3dd4

SHA256
110ccd760150c6ac29c987ee2b8f7c56772036f6fe74ff2fb56c094849912745

SHA512
5c0edd336a6d892f0163aa183e5482313dd86f9f5b2d624b3c4529692d70720f4823808f10ee7870fd9368b24de752b343570419fd244c33ad2d9cc86007bedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
62KB

MD5
98f0ddfca3274d3e37b9c08e2a771387

SHA1
c4945a1b421268c79450fa8914c3bf0816b91e49

SHA256
b2318be09f8a3fad31b1e61e16fd5eea8645b5a46e682f2b128ae5963ef587af

SHA512
97f6e343a5cd63a9c25427ebfb747b3bb3f84ea4d4be267c02fe88b4fa5485e5b24b6b134a010bf07d8bd1d826c1f9b49de266df84e0e44557af29544e617d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
44KB

MD5
fa638a0d4679e46bbe0032b3f7c179c2

SHA1
97dea093b48e011a9cf9ecff28af2beca2c961fd

SHA256
b1e5f8503594b491e767d81ad8ce70cceee9d25e81f6487313e7b9abd2b7c31b

SHA512
470caf93efec4f063cb01fcf1c8e62e8b24db44ee7ef34618e91fa5adf8d411a88e540bb44248a9fc12e33d2697f951f1fc3832e4914da4a1c41afbf72b52863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
25KB

MD5
ff60bf413ce1a32ed731995b52f156ee

SHA1
bae3bfa595e67b7eb8a7bd65f4066556733ba3ae

SHA256
40335bb762319ce572dc54cf00564b469bebed5d945dc2380acad6fb469f5ee9

SHA512
1f41d597b24fbde5f28d3b1d2ebc13a6db03f8f697c9b5eef742f0da0ff72199b5037b91a6b28474b073a09c7a919a803f41d0cf755b871c52aa65c677fd2b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\115807c81f46d2fa_0

Filesize
4KB

MD5
6b7c46091a7b773dba7195881a312a95

SHA1
df8231305e702707d2c84a8b04c8796e716ab835

SHA256
00527099c5e59150ba7c3721e0c1a488b4edc41aeb09f7440ef0156a11342bda

SHA512
4cedd216b004176e58db6789ff33e1394d8cab3abacc49d81187607f34c2445269bafe93168cd1d48cc67f3fa3641ea58fa35cf944171a92662327b8c3d0289b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2ced246d98cd3678_0

Filesize
366B

MD5
bb1edde5980fbf6e16ad4af0068b570f

SHA1
7267d80d959db2cad7de80755b6be935b37ea7e1

SHA256
3569686e068796abe2b9e813714e4ea1feff6a77ae7e89b81f360afd37afc95c

SHA512
5cea6b898eed047a152de6f342864c4efdc17a5715c85f1bc3bf6b9374f4cdb481728b015929a78ebcdc5529b775538726b246003a38411ec54790936904b914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d9c813a0dcdf108_0

Filesize
5KB

MD5
cb998b01623217cdfbb245332b8026f3

SHA1
a7b3cec728d31c9fcf2faea4ab411206402741b0

SHA256
828a2050ae471286b388f4216e04fd10bf85cd1aaa6ae313b9644cb717930f0d

SHA512
f9d7c5cd15900f13a87b9c8bea5acfcb73e81425596d383619164a5ff228eafe4bd77de48a948d867fcce40334b341d96ba3c805060d6a5abe6bf6f54f6900ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\311f97ecf058f007_0

Filesize
1KB

MD5
fbe92c50644d58e78adcd79177a00b0e

SHA1
85803bc43a146ec49d1296f8fb6f659e19055e9c

SHA256
db0f717b8ab179ff462e75f2370269e03c9cbcc3bcc1204a98ce3a6fdd000449

SHA512
fd1ea4d064f0279b7d08977a7d7035ec589e1db41aec1d2f435b21d97ac2d8d1709dd9603a4349d145fdf1235543bfb593f8b60f276db61d68ac740102ad6710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f8b23cc82f2b2e7_0

Filesize
8KB

MD5
ca5cfaa52c013e74a0de8bad5f6ab5b3

SHA1
f18b3fecd3c60a8e4b8cd14b1d0456b213484961

SHA256
5416887d794549a3c6d539a56f6820da0eb6e64be9172e10662918967097d3ea

SHA512
81e142a351f16309887441187cee7347a5dca0b5aa2f9c45c20c44701ac6cf1d9d5c528d2de49b6805a787ad0bcc72b13fc8b1af95f8f5fef04c336cd28f6955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\427075385d94c9da_0

Filesize
3KB

MD5
f457c26aa22b6b037c5aaabe2d7c4dc6

SHA1
4b31904a6eacf8ff8faadea7217693f8a249a704

SHA256
35a4dfb1d250a1b9bca04222cbbaf651f76139627d9aa43d80b2e0cf940621bc

SHA512
ce054c087e693d3c477042ea7aeac6e3d90dca7835413f1ee04e25357b9d8404eebc919a29aa6d47e15cc800cec6c5a1353599be2f1963f93adbae690659692a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a05b0db8f454e7dc_0

Filesize
11KB

MD5
84c99d4b0a5c78380ac293c43a092c91

SHA1
2ccb2c9dd7c08ff29a3217a5339a427635601049

SHA256
f14d55b1f5caa85d3d0a711477652d49f250e2cc04e954687583d5e24f1d67eb

SHA512
cc819964321a45ac20b9db74c37c083ad836578bfe90c752daa5c6626aaf4c69ce580983312d7c46e80a6a2e8659cdb1f9d0f7b0f53f5c74cca1734469c55872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa61758ad53dced9_0

Filesize
1KB

MD5
f5541560555665499b29c911ffb2a3d3

SHA1
d2f016ec3b1ae566e05a2d811e31e7d884e32100

SHA256
bc47eab8147fca5c7b3e6129478366fc6dc3f27bea77c4c99e304337dd90a939

SHA512
ac5bd951607a23da4e1738081445155e63a96d6fd00be9527b152146b4958b200da165178d815193af9e823601fe40e596402cb9c7460f3a271b7e859617ab67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4f2da4e4b4dba36_0

Filesize
35KB

MD5
8eb0e246d817abad2ca9ecb3e381632f

SHA1
9eade836452b713d084c70fc9e34904222187eb7

SHA256
08fec11f3c968590ec1999e7f00b0fd562a2dfcebb058a5e40222dc989c1e8ae

SHA512
7cbb475998a0316897beca35be69127345bcf172a71f7bec5ded56bbfd20981c493759da6becd59af69401ba5e3f22ccd2957dfe12a9125ab23c24e94ab0276c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb307b4160083434_0

Filesize
11KB

MD5
f843adf112355fe85f082eb8a9a10eca

SHA1
b34a9717ca1419077d7048aae6d668d402f31ac7

SHA256
6f5fb890961fc057df7df8879e7f72a3fa1a444b62cfa1978013212649ed36c4

SHA512
e16ad9269f4d78533f6815df3a8623aa3b8a376f80e6ba75506271364ec87f05fb3c25c9b6d205eb8b92ff8f52b3a5e6cb7c06a46a129fea4882c6a11c692d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf30f5f08922278c_0

Filesize
73KB

MD5
6a0733d8a3722b38ab0a1cc4a52a9b65

SHA1
da3493d5fa30f536d69353a6407b66216cec179b

SHA256
a8cbe17d6f87422b153e342360fe237bbfb18a6fec1dbd4fd0b9d7cd7ca1efc4

SHA512
0157de6019a4d9d89697975f1a48d329cda7f6485a7b322e405b2f564ddad14e675b5da8ca6d22aafaf2810e4008457751e8d894cabb430ae63b5b8bf6e9837b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5667bf87cc6b1b8_0

Filesize
1KB

MD5
e6e378b7eed37139aa6d9c933c638308

SHA1
7c1484d8a370d7959c4daed43bc955016bb47d17

SHA256
5e8acb24dd3066ca74ee186e593575136cca2c3518fd21318aa1aecf422d00d1

SHA512
d3e7a227ee19372725734b4cc92c31b082ba1efa9009ef3655618bcd80bda6bee76a7632916649c09b38098b431e78054b85c70dc630a121d0bbcdb40fddc460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d6ee81079c1cbac4_0

Filesize
2KB

MD5
b867f4da17bef7714d4fbc1f1f3a4eca

SHA1
622d0770b89fde0135637a37b26948f614616dff

SHA256
6a372c556718a6732499005145f5aef152c11269f34a3a80d0eb163eef328e4a

SHA512
f182aa87528289547ff9e7cc0b2edf7b5620f61d39ffc86934d6fea29f7c03194b69856d3a37675aef33e1da0062946ca51a846a799c52c9e30a26eea9a162e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e88c26082cc48958_0

Filesize
2KB

MD5
9e8c0325c22ccfe8503f68d59d274202

SHA1
d605a5de19a8e76472d49e677d5f5571619c1cba

SHA256
b27c1fc6efb9b77c5f009657396b4f47ea0db257401e63d301c906cc39c42052

SHA512
f8292ab33bd1efb89be559751c4bec90c0f2a9385e977799e425d42c4f53ad371adee970ceba2c1b9559358db77f0ab378afe7f05674bddb4fe5fde76ac5b889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7bfefdb1b340afb911af2b39f8588eac

SHA1
b2179ed1b35dc62caf71677b0fc6c4845421aa59

SHA256
cf4308fe6fc104de678de81deb38543f2bbd2c3efb1dcf79180912ae62e0521b

SHA512
c5423a64b15c0f628d7a6cce6cb1ad2dd466bf451d720c30ae83266d39bc5a1a8077d85db281710e3260821c2007cc2ce9e73b6af29a7c3f5055d83fb8d4a569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1fca9ac0d18779c8df822164874b6fd9

SHA1
d44144c007f13e1e022a61a59c46a0baf1d2d347

SHA256
905d82550acc1bcf44999c224ee7c41686822b32ce9c144cb96cd078c86af2a3

SHA512
532793df751e962863014f1bb4259f59775d05c7ef142d2c5f59e4e3f5910b7d3c2b0c5a33b601db819fe545beb21230e425974d8c115b58b29445e48fdd7c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
74c8123a642ed7f3674a1c2c18ac1b5b

SHA1
03c454b2633dd86c5e41d3fd57906958e7df8f9e

SHA256
97d69f305f22697f39017abf09dfb4bf4663455a953387cf67ff874a481ebf12

SHA512
5e7efa3d9490d7682bfb30f75a867f855bfa1d304ec6c3613f8a194240ff676ad502648c21db98051c1256e37d78f22393a1bad85994f2c657e5d7f626ee8b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca494e5d182231a07a4b8988a01915a1

SHA1
b629cbce6ce930ecd8546f9a37a6e4295debb1e6

SHA256
1961b88b383c1b5a85760d6cd1c2f1834ffbebbf793852f8837eae45cf7d6300

SHA512
8a2b148d30a45c641fe31e46968dfe593f53012516243265ec02d8fc240d96aaf08f5c99f8679d63be235ceca0927884224dbb07230556941fd9abbcac28c2a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54cf2fff3081b6d890fe7fd8ecedd206

SHA1
ea465d1afdfa31513770dd95a5f61d3fce73354d

SHA256
cd0fb18d269f3bdd0ca02535afc9f69def24fd4447ba7ea8b7e7f54e98c1910a

SHA512
fdd2b50c42084fef8cd5e1b9325b2e6c1108a4458c5a5cbcbb7e7d1e0c56341854e8d9702f9b4a9c0c581e7b313369ba1bdca9cfe5dbf33370f12a3249a1f9af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa12779b7d501860ab58a4da36004680

SHA1
2e2b4178f6df73837d00f62ce7704daacd91b497

SHA256
4122f739978f887c768f07eb48343b0dad3114f42a419c288fd81571d3ea0417

SHA512
fa478c3afb4463e384a067558b7419ca39bc08f9ee68d34b36791fd9967ebd1a87ac700f1146a2e33df5ae0bc83829e078040b873340013075093d800abf84dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20e5344027aa13f3713be88cc8dd6644

SHA1
c81de81afc2064245098891c1873451eab72001d

SHA256
e814fc73396855a7ce5ed15985db864a4ea9340ae90f2c04e1a96dfe03d7672c

SHA512
0717540a0d9935279d73bb1120442714c2ca866381b684665c619c3861687ba62ed4b2425fc76cb66f5fab1c34e81db851ee7f836d03ef8024d874678cafb821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc12f669f30b23086b601ea86c96ae55

SHA1
169eb5f315257a984997548d8885d3cc1d67053c

SHA256
03a9ffb2e6c49cf2433764e4f4e89e9d705b8901f8aa509fdd30c63e5b226dae

SHA512
fe71840ce7c333fb32e279ba0b59ced618d92a4396810bc970fe2e2d495afd40ddce9a0dd068fc2835c623a492a03284b5e02c6ec6c1358e05427bb42efb2967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff4405bc0635283d652f1b1d8d420fdc

SHA1
808ca27c2e5717e12f97775b27fcc0f4d9f5f52a

SHA256
8b109b4ee72d3db1bbb77c7c639863c46a51fb9babbdd50a0b8cd7ff7ffaea7b

SHA512
2a72b1c8cd6a2a61b9377a7b0f8d1e8dc92c86689acbf5e517d81ff99d0d32445d853d3ce002d88e55ec7f27182628d0ea5c2cbdcc602f46854c9c83b8a1f984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86776e50dd96f036e34487615e5ab3d4

SHA1
929456042fd981e42b4ac61f8bb549e3f7aaf765

SHA256
ebc11f8960ca97ee90bb06350859770baf4ec70dfe97523578de1df6364df7da

SHA512
950480bdfcabadae17630fffafbf09437859a04ce089b3f5272e166e9884686414006a8c08ad14fcd758c59e52c976224491b104905a556d99adda423d0a2ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ea7597dc0d795fdb7246f18955e1db0

SHA1
d426e99b053e561d7c14343967953ea9c770f1b8

SHA256
a602bca94c542ca4a9c0d63f508aa1dfef3753bbb067e1c85e16a026c2e65fc8

SHA512
a24bc1a67c4c3e35b84d788d79a6f385d2f46bf9a729f0510d6ec3e576f5acb33d87302fe071a43334abb3de5ffbea4ba238c3ee70139df81bffe88d534896d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
08cc319f7e04785ec3b2c32d53bb3925

SHA1
f5c4acd5fa92dc801550bc7a7eecb6e4acfadacf

SHA256
735db1263907cb7d6612248a6e7db5d00714e1b8e02ce13fa4c6e0a1b181f89f

SHA512
0d0dfb28771741494e61247c954a9441f7bb62b12c02a24afb0c1f1df52c1eb8aa13bf8ba6a84e54f7070dca405f3509f584400c46c23525ed5f5db00d962c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0092bcd0220cfeeadef51956c3ce0527

SHA1
2fff6272121e238814fa6e6de11a5f25df4b61cc

SHA256
96b65c86cfd4b5d94f16969edcc258570a5ede41378df44592f3089394f4274c

SHA512
e0661d13a641f59bb78ab697656397bbdc0d1154bb47a919bea94b4505596ee789acb1dc50dd30faf305aff93831e57007d11525483a77ab55536097c0e987c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8171b02f7576c37b14c4bbdf45ce1e28

SHA1
55d1c05232b02bdd1d6da552ff0468ad01d658b5

SHA256
e2b27b8920c03d262f373683db353c15fef0e1d35ccff62a4968caca786a330c

SHA512
c6bf725961b92b44538d4fe3a0164ff62087e81cf18546d9befddca0db8740e4d0bed21e078166fe0fd6930cb2a70152eb7b505e2e94954e766ecafb420e28d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c1da0b920f0a9b1c5fe37b3bbf5197d

SHA1
97f5ea1474738fec194f7f10c4b42b59aef9beb4

SHA256
8852cccd8ac6fe01af8b0aa1f0519559378d1e05c3c85454a6c15bb3079eb648

SHA512
bff1a7a14954fe92db542ad5e58dbc9c8a51f3eedc621bd816800a31dd5a9f317e6bdbb0a9a51a09fe76cfc843fd17e05148a857d696972eed751ec14e310183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5825a4.TMP

Filesize
538B

MD5
0496d3b5bbc3d21302642e43be1a07ae

SHA1
822859b76c9bcabaefc04e84152577dcf3ae046e

SHA256
617d35e976595465b4beec5f12154504723025481231e7c3162489a8d02b05a9

SHA512
f10d5c2811cf10dbfea0bf945a9650102abad08dae991412afd067c4d58cfecb8947c0dbfcced588280d61a79b58c51085493201bdf31d7eca336adcdcfd36db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
66d23cc671ec0b14817a0bf64111a599

SHA1
3b0e5fcca977d5111daa8b8bc36cf7f7fec5be92

SHA256
436d034d626180e192d7095ea6758566c3ee93f939cd235f2e5cc1f982d097f0

SHA512
ac8fec36cddd8c217016ffd5a60c3428de78821fe8a91fb80c15401c739895a28a5ae7dae313f550ec3e8467b04402695f3ea5b4f24dcad5bb4caf855dbe68e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
56633b73cb57b2b316d0a155e31af827

SHA1
1de219c5f87a5a552aa072fab3c744a8e5bd7513

SHA256
b8fcaf328310b8aa7a2d2f1088e56184765093b7c62593ea0e04e82f3f301250

SHA512
fc5aaac3ee9cd36d517463756bd44f920af5c8fb94834148e459f48a47e3a42586c4d21db47a531d2f3517f4b6847ab0be75cbbc6ba438842ee024fa6346d3d5

Download Submit
C:\Users\Admin\Downloads\hosts-3.14.93.zip

Filesize
30.2MB

MD5
ce6dae3659a8dc62cd45d2a9951df5db

SHA1
5196be5b81957f4db1bda522b44cd4f336ee9fdb

SHA256
9062c4655433fc840ec920f9d037935d8c27bd642701dba39bae511f3b84d498

SHA512
c4da834f4331a685bbc2b10e505ae9166fb1d522633e610e4af8b2b56be1eeb170d4ba2790b6d3b1f0e5118686cd50e2444746472c41e119fc37d56e5ccbf125

Download Submit
C:\Users\Admin\Downloads\hosts-3.14.93.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit