bazarbackdoor | 8ef176944e54df85db028979ceb66b2b6e807b1615f4254c273d4b433caec0dd

max time kernel
1050s
max time network
1050s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dl2.exe
Size

849KB
MD5

c2055b7fbaa041d9f68b9d5df9b45edd
SHA1

e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06
SHA256

342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3
SHA512

18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc
SSDEEP

12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2

Score

10^/10

bazarbackdoor backdoor discovery

Malware Config

Signatures

BazarBackdoor 64 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

backdoor bazarbackdoor

description	flow	ioc	Process
	240	zirabuo.bazar	Process not Found
	253	zirabuo.bazar	Process not Found
	270	zirabuo.bazar	Process not Found
	212	zirabuo.bazar	Process not Found
	213	zirabuo.bazar	Process not Found
	232	zirabuo.bazar	Process not Found
	239	zirabuo.bazar	Process not Found
	238	zirabuo.bazar	Process not Found
	249	zirabuo.bazar	Process not Found
	261	zirabuo.bazar	Process not Found
	211	zirabuo.bazar	Process not Found
	220	zirabuo.bazar	Process not Found
	227	zirabuo.bazar	Process not Found
	233	zirabuo.bazar	Process not Found
	203	zirabuo.bazar	Process not Found
	228	zirabuo.bazar	Process not Found
	255	zirabuo.bazar	Process not Found
	260	zirabuo.bazar	Process not Found
	269	zirabuo.bazar	Process not Found
	223	zirabuo.bazar	Process not Found
	242	zirabuo.bazar	Process not Found
	244	zirabuo.bazar	Process not Found
	251	zirabuo.bazar	Process not Found
	257	zirabuo.bazar	Process not Found
	263	zirabuo.bazar	Process not Found
	201	zirabuo.bazar	Process not Found
	202	zirabuo.bazar	Process not Found
	222	zirabuo.bazar	Process not Found
	245	zirabuo.bazar	Process not Found
	273	zirabuo.bazar	Process not Found
	248	zirabuo.bazar	Process not Found
	215	zirabuo.bazar	Process not Found
	216	zirabuo.bazar	Process not Found
	217	zirabuo.bazar	Process not Found
	234	zirabuo.bazar	Process not Found
	207	zirabuo.bazar	Process not Found
	250	zirabuo.bazar	Process not Found
	256	zirabuo.bazar	Process not Found
	262	zirabuo.bazar	Process not Found
	219	zirabuo.bazar	Process not Found
	264	zirabuo.bazar	Process not Found
	230	zirabuo.bazar	Process not Found
	243	zirabuo.bazar	Process not Found
	259	zirabuo.bazar	Process not Found
	271	zirabuo.bazar	Process not Found
Key created		\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe
	209	zirabuo.bazar	Process not Found
	229	zirabuo.bazar	Process not Found
	266	zirabuo.bazar	Process not Found
	224	zirabuo.bazar	Process not Found
	235	zirabuo.bazar	Process not Found
	258	zirabuo.bazar	Process not Found
	265	zirabuo.bazar	Process not Found
	267	zirabuo.bazar	Process not Found
	210	zirabuo.bazar	Process not Found
	231	zirabuo.bazar	Process not Found
	241	zirabuo.bazar	Process not Found
	246	zirabuo.bazar	Process not Found
	252	zirabuo.bazar	Process not Found
	254	zirabuo.bazar	Process not Found
	268	zirabuo.bazar	Process not Found
	272	zirabuo.bazar	Process not Found
	214	zirabuo.bazar	Process not Found
	221	zirabuo.bazar	Process not Found

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

flow	ioc
221	zirabuo.bazar
232	zirabuo.bazar
239	zirabuo.bazar
246	zirabuo.bazar
248	zirabuo.bazar
212	zirabuo.bazar
219	zirabuo.bazar
223	zirabuo.bazar
225	zirabuo.bazar
229	zirabuo.bazar
271	zirabuo.bazar
272	zirabuo.bazar
211	zirabuo.bazar
224	zirabuo.bazar
237	zirabuo.bazar
247	zirabuo.bazar
265	zirabuo.bazar
216	zirabuo.bazar
243	zirabuo.bazar
259	zirabuo.bazar
220	zirabuo.bazar
228	zirabuo.bazar
255	zirabuo.bazar
263	zirabuo.bazar
270	zirabuo.bazar
213	zirabuo.bazar
250	zirabuo.bazar
230	zirabuo.bazar
215	zirabuo.bazar
249	zirabuo.bazar
262	zirabuo.bazar
214	zirabuo.bazar
238	zirabuo.bazar
244	zirabuo.bazar
226	zirabuo.bazar
256	zirabuo.bazar
264	zirabuo.bazar
273	zirabuo.bazar
254	zirabuo.bazar
218	zirabuo.bazar
222	zirabuo.bazar
233	zirabuo.bazar
253	zirabuo.bazar
258	zirabuo.bazar
217	zirabuo.bazar
208	zirabuo.bazar
209	zirabuo.bazar
227	zirabuo.bazar
236	zirabuo.bazar
242	zirabuo.bazar
245	zirabuo.bazar
201	zirabuo.bazar
266	zirabuo.bazar
234	zirabuo.bazar
235	zirabuo.bazar
231	zirabuo.bazar
252	zirabuo.bazar
241	zirabuo.bazar
257	zirabuo.bazar
267	zirabuo.bazar
269	zirabuo.bazar
202	zirabuo.bazar
207	zirabuo.bazar
210	zirabuo.bazar

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	144.76.133.38
Destination IP	178.17.170.179
Destination IP	176.126.70.119
Destination IP	172.104.136.243
Destination IP	159.89.249.249
Destination IP	31.171.251.118
Destination IP	82.196.9.45
Destination IP	69.164.196.21
Destination IP	185.117.154.144
Destination IP	81.2.241.148
Destination IP	185.164.136.225
Destination IP	185.164.136.225
Destination IP	142.4.204.111
Destination IP	163.53.248.170
Destination IP	158.69.239.167
Destination IP	31.171.251.118
Destination IP	188.165.200.156
Destination IP	77.73.68.161
Destination IP	158.69.239.167
Destination IP	51.254.25.115
Destination IP	139.59.23.241
Destination IP	144.76.133.38
Destination IP	111.67.20.8
Destination IP	89.18.27.167
Destination IP	139.59.208.246
Destination IP	169.239.202.202
Destination IP	31.171.251.118
Destination IP	51.254.25.115
Destination IP	91.217.137.37
Destination IP	45.71.112.70
Destination IP	185.121.177.177
Destination IP	185.164.136.225
Destination IP	130.255.78.223
Destination IP	178.17.170.179
Destination IP	77.73.68.161
Destination IP	198.251.90.143
Destination IP	163.172.185.51
Destination IP	144.76.133.38
Destination IP	5.132.191.104
Destination IP	192.52.166.110
Destination IP	142.4.205.47
Destination IP	51.254.25.115
Destination IP	45.32.160.206
Destination IP	46.101.70.183
Destination IP	146.185.176.36
Destination IP	159.89.249.249
Destination IP	92.222.97.145
Destination IP	94.177.171.127
Destination IP	107.172.42.186
Destination IP	192.99.85.244
Destination IP	104.238.186.189
Destination IP	69.164.196.21
Destination IP	139.59.23.241
Destination IP	45.71.112.70
Destination IP	45.63.124.65
Destination IP	51.255.211.146
Destination IP	111.67.20.8
Destination IP	91.217.137.37
Destination IP	45.71.112.70
Destination IP	45.63.124.65
Destination IP	163.172.185.51
Destination IP	212.24.98.54
Destination IP	45.71.112.70
Destination IP	193.183.98.66

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
146	raw.githubusercontent.com
147	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{C1009B32-0EA8-40B0-B672-7AF719DB73A6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
548	msedge.exe
548	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe
5040	msedge.exe
5040	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	dl2.exe
3276	dl2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 3780	548	msedge.exe	92
PID 548 wrote to memory of 3780	548	msedge.exe	92
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 1256	548	msedge.exe	93
PID 548 wrote to memory of 4816	548	msedge.exe	94
PID 548 wrote to memory of 4816	548	msedge.exe	94
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95
PID 548 wrote to memory of 4696	548	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\dl2.exe
"C:\Users\Admin\AppData\Local\Temp\dl2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1044

C:\Users\Admin\AppData\Local\Temp\dl2.exe
C:\Users\Admin\AppData\Local\Temp\dl2.exe {A4DA513F-C8BF-401C-A406-6C9C1A964A6B}
1⤵
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- BazarBackdoor
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd2df346f8,0x7ffd2df34708,0x7ffd2df34718
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16574271303712412714,12112882228432387419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
23KB

MD5
b6b7ef4472b4b6a78396962cb4cf9577

SHA1
61e1cc2989745265ec400dd370f544ccd25dbcce

SHA256
516b4d98912d49e56a68c5dae2cc19cf782d4796eece0be0182dec95a915242b

SHA512
8cac3565a83d41304fd74f6c0302af23b2eb2649625a3c51593b0c0bf6308b49f117681047ad56db77c5373b029e338213311a7d78dd17439374f62809b26a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9b7e15d31677abb75006f12519e9c869

SHA1
92b62948dc01ecf1184d2a819ca4a46732d0d7ee

SHA256
3659c291f260290f1b9e51aa262c69dd9a9bcc55d72a19fec97081b449cee9c5

SHA512
87f4646be1d538f619cb8279b38938446ce03a98fd73069b5feb3fca824b6746e34febc8fa08c47e884f054c68589530c22c76395f87725b1f321eb4f307ae30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e7a2dd4dd1a83bb7ae69c69f51c3bea3

SHA1
9ac1ec71eb2541a7b0f79303bd56edf71636c36e

SHA256
a49af47c3cbfe717217244d840f3eca3036437444e3b786314e207b22c189bc2

SHA512
188c9c8b5b17b0d1bd7c56be65972d17749cba8150ee43d71dde07ffb5802b9df391e6a2905e105fcbee21a2007372f1691f74ca2ef131ed50941a5eb6c0ca61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
850B

MD5
2392f24c20b6fd67e94a35e6a061e191

SHA1
d4cc5ac862de632a712cfe9bfc0a18c79c33ea00

SHA256
71e63bc2f17892df295d1143c651fffc53374af48a0df3b981d74487daeaec53

SHA512
7e5745e596c9cc14a5d3f9b63922e6852c762758e1e160915f1937e9eec100ba48bb11ca808fdec67002af1d660d3505d94ed21629edb6423bd8ef6b6a7c8277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2333b6dfe74881f9e630533548b4a21a

SHA1
9865ba8d7a04ecd7cbc5a92c782902ea580a1391

SHA256
13e3b7801ec8a6fe67f8d7454c1e003bef621b7e88acb2f3531240e6c3918392

SHA512
6814112a50f504fd8a28a6ebb5e478b2a4e94df7577173fb7ed53c7ca9b8b07b081b2af9341297bfc7db4312d4828a67b7488693f10c62b4c8dc5a820783e9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
850B

MD5
260eb326df5feb28fb0c17cae339eabf

SHA1
38c473b0286ddd5fba0e779b65b47fba1ef4c835

SHA256
bea3f2b07a7edb6a49b2534089c0fdde76d36b8dab17c0f8154180419464b5d3

SHA512
bc5ef71d4d6f55b72244f5961d1a3e72f1b61585ff4bc02c789c46ff7ae58e9e51378bce5ceb8df520af48a8a4f2b3db98321f62f7514abfb31ff3f154ba6a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d9477ef092ee98ef3c1fe1f656c9120a

SHA1
93f77760c631d5f0c29f996f43093c302f5e32fe

SHA256
86dcb988c0fa0d320b10e8fee58f44ed1301d8e3febb75943d38567ad85ee8ab

SHA512
bbac4339cb58f3857866d079f09a88840b431f07b33f0d739bb7802d6514bcdd965885a69b71353deb39e90040261a50d72aee5d5278f0f1793887e03e7527d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dffa42d90db30fb6de4079a906118e95

SHA1
4a3a582f8738df363f2e5d65d38d865f64456403

SHA256
98add143b8b2579c7d8ba0952d9a5d03fddd01996525d8103ff93f2819a56382

SHA512
03531c9759e2478d139418cfd0c8f16ee6059e92dba6e4410163e3e200974e8e09c7290035ed6b22e25e2f5a32bea472655889157b28e3f7db2222c49fedba91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f9b77dd92b044e31bfce7a2e459fc112

SHA1
3d9efafde442c602e732bf44adc717e8e30ecefb

SHA256
223093c6f3a09503ed2cdf8ed8f1adc44c5fcc4a003c65a87bab3ff166d97dd0

SHA512
ce95201a38a895a9505ad0771902c73be03759229b3ebd810bb5982c4f595fb5533c2ea596d7ff8054644b9b97d19e66ed19c2dee3a0e9f66a61245506f9f50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b08d7ef3efb4b9bada8d54ca78d2f639

SHA1
39a48b57c5a7f80fd34e46b1b2e02bf2e70be740

SHA256
95105bebb0a32dee165c347d3b82541d72d8b87675e019f6816e72cb3fb7eae2

SHA512
cec311d4205823c8be5a0a4150ad1a0a15750a99e833347a442c9bbf2edabbd2847c198e8ccab8c0469fa46bff3f94a16680ab684c4ea7c8622ab99970327af9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cbb4d1bc12776737493bcef120282fdd

SHA1
d70b77abd9883377087d0878e90ecd82200fb67e

SHA256
4c5941793e3bb5827eaf0cd2fac775e6170238d0137f764cb182e56aededc6de

SHA512
011007f3f06747f792e6ca5025abdb6ae39ba4d9f9a2862ad51514b3a54b7c15f9d97ecad8699c72ba086e94a205323774542d94a9abd6849ade8ad64a5ea9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30c41eeb102cd4ddf09a319c2c612890

SHA1
3353ec69004c6bf8d2af23f9932b3a58a85b5251

SHA256
16fca5d279350596636e0c64c29c11fab07eca9308168e2772770958f652f6a6

SHA512
b5dcbd3f2970b09b75b24ed6e890718d0d255a6de45254fc00a66e59cf25cc743021de1371f756fcc041928d9b5173e88c9ce34a0625eb1edf084b28f230e8d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d297eec3cf4e538ef5b297b432e8bed1

SHA1
6c2a3bc4a7753697e9d6bc3a8e51f78c0d130d89

SHA256
45eef84bb49cb4da1da5a5091eac2865aca0c63a6855dd0a04c4ec7d993a4dc4

SHA512
8d02da6214fb58564b7b03091d6f116b0c98f0c8cdfdcdc0600dbae367375ad1c0b564b00029f4aa6a6260e3237b2d0414efe81c635cb5f82405d4b5fa882f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d874ee630b9f496059481e50fd87cda4

SHA1
f357d70156bc5672f6383a80fb562d298e591400

SHA256
fced6771b081148ac4f12c338198021986cb0d2a58872e7d28881e32e3e7303f

SHA512
8715dc2a8f2ae3a39051d48aaa3d253a025ef44d918188471ca12ff4b43c53ee68d5330de6946c156f58dcb40e3e60a5c979d6a396aeb672270d8505f1a8f5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0ae6c452dca99141dbefb46f07ee9b8

SHA1
6351391731892cd92e0750dc1f39ce15cae6f294

SHA256
319ba915e1e71dd01490745cc93b9331147a4feef836fa6c3db129630facee21

SHA512
b788a9ae03e5ea7156610cc2f96bfabaed6a2f3d7808967dfab3bece3ef31471367a3f27df0bf655a336e376cfd03b317e82192050ddbd8b7e7f3add7ea66bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6aae963a4b3c0a3addfeb21d93b3c908

SHA1
248d6703c93d61394a9ecdb60f0faad03d9b450d

SHA256
90088723e0f5d91a1a318b3471dc110e0c650ab049ecd0e573954ee7b0bedaa9

SHA512
329514f2fb90968a288fbddf318ef7fac8a28ed842d4369448ff35b50f862e522654609b1a8f6614174f57dc669c327c0667b89c15da126342546955f104094d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ea96076ce9f24948dde5f1a58e69ab8

SHA1
8114dc95a1f8c463fa3411268ed5cd681a206586

SHA256
72e7c13fb9db0d008a864e10551c0a1a1069139c1d8331c8b84c21cc894b7ab2

SHA512
b16a8a98fa963f4c3f0a01608de53d1527d40ecd14f912b90bcfe9a8d559061ec07ae464712d494abb1e1d62058bc2ad5c116add5971e25e38e885d58350ac41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1c5310e93d377c548ef89ed9b9d839f

SHA1
d9e52efee97afff7ee3c439493e7119779cdc545

SHA256
e4f02a392cdde60faf7ac23f255d31081081450181d8a15272ce3dba586ee4b1

SHA512
e8b604f91bd654e6f5e5692d61b6e784f3052c8f4e93328e541751a5976a1027993e0ab5f8ca9f4eec289e400a7cd37747a5d7cf6fecbb69cb072b0ffc2284bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
97c1e326f6fcd8e0230f32851584768c

SHA1
9b4ce954316fb55a923e15fb989d1ad366652f65

SHA256
f1a3085b9734afc38f95c3b02f0ff5d80545f2cef836072a80c98fa953e46b9b

SHA512
0c894c3d2850ada8a6d58d39428893adaec6ff9db37ea2d95a2322ef6466afdca9b3c338384b04bb72bdc51257d34e4b9d2449f9dffbd77af9be6166e3a7e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d56c7ec9882d1c5f32b43a47e36291fc

SHA1
36871f7c2a4806422ddd437d03ad6296eac3c352

SHA256
d915525f0445e96f3a46b859c371ad676fa7fb62d4aee1e6da2922f6ab94c2e9

SHA512
bd80e6f22762bccd3d53a82ac2cbc77de19963aa8b07c2805089ed8d9180b46baa00d4abc0353cd18e9226606ce3429e768562d601aa220d97a0b501c031b129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
04488cf48108d96d7b9458c1246ea4fd

SHA1
e3b920245ba581f39509303f703b3614c451f66b

SHA256
56cd6b4d4675f7da2d20dd9c2b6bc58bb10ac1413310150910e6b66fc154f307

SHA512
852e5668fe0457e076a221aba290e6ef79c9ca0a536aec6ab25d99ced2633b19894dcc110093401052a86dd6db4c05a0f602b4818248deec0403bed7b8d10e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d0e95f8fa3779985353e72b59fc2d27

SHA1
b27fb492f590f5e75b788637c0b4655eb0825801

SHA256
5d0509ce787cdd03c90c066994cc6bf4ae655801922e092c492aa4b6ebd46f31

SHA512
7c4a312cb66f918465a75d97a82963d6bdaea6e1fbc9cc1f2a3e27100651c2d4feea801d47d2636c4a511d9ddba9458c1287ea8767e7a1d614e9a805cdc7ce10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
974212e5f666ba4f48cce1d5b2a0bab0

SHA1
2e9a3e4e49fdd5e0474e405b542bcd5f4e015cc1

SHA256
d3f93caafc98ee5a8cb63d5719e0ccb14883c5655a38928eedd7930f20096e31

SHA512
bd45d9b75199e3396d0b6622679fafec068ca012ead9b74ad9b817855614726f7d47d5e60232a766d9a1266d0fd434a117fd5da31dad1a91be5570b4afece5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58fe31.TMP

Filesize
370B

MD5
8fc9eb9141d47450d3e1ccfa256468fd

SHA1
27f6ba654ba15dda97d34aefae70d182de9a071b

SHA256
1e4f6ed1a4003cc57520e44908fd1a718c666df363e33f76c0bb3d60070ffeab

SHA512
2e33e4ae5779fb778f740b50ca00c37f264ce4d15b60331a5064ea21020a6c7dd389b7b0905f34d08080112a5c1bb02351238f1d3d51ca4467d80bc8b1df8f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
9e1247749e73b9d110a812a42fefb377

SHA1
dfc3593eff7560dc08ba7916845ffaf8b2517f8f

SHA256
d0de3cfa84e80b24949a572ceec9592ac9b732e533651e7effea9e5a294fa1e4

SHA512
dd8feeec63ba04df6e0474c77ad6655028c851244a2a35af2bb5bf641cf0e7a53452d14754f9f43b8ea3f89a05c82d7f6280329de2e853130c55eb2eeea401ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
97fc43420cc8af11f4f2a1301528cf4f

SHA1
89bc63aa9e93e73a2f1e360a67c39cdd0620d111

SHA256
8feee56fcadec5d5a7d0cdf13330777cb4c4b6d92c4c6f4cbe54f5a2c906c019

SHA512
4a0f6049d31ad93ba7f5fe7b8bf8b0ae991e8a837b69460b0b4e3974f1499a75ba54d25ec2c1d5df3b34b8e6aa23cc72dfa961318d4a7f813540901c10603368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
eb619c5f5cb70f1faac7d258d66d6e95

SHA1
1a82655e286b7037aefbb42be68835140473da49

SHA256
c62434ab5c85baa53d31f736fad394fae63fff1d35882ae4ba2ba43fc719659f

SHA512
ddabfb27c0ad33a513ac2e7da4dfdda4fea32937265b755683edf56523d9a824077063caa3424daa07e58a0b4c253fac266b3703c86fadea20533c41186a3cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f4b09012db8dd2ff221796c1ebbb3522

SHA1
9313c55463666d97e467dee5d67bf6939839e2e6

SHA256
64fa9bd76d95baa792a415bae2552cc6583b29fc6fa097305d4fabae219d3bf5

SHA512
e2bf83d72f5ec1e7fe231867c7c9c4470e2dfe1b2a8158fe32c563bbfcbd35645038b54948c4bc4172190adad144ef815ee1ff2e34616b075419077bbfbfdbe4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
bc667e8435815749bacf50296cdc3077

SHA1
dd34489099ac3c00970031fc59bed94f91c338bc

SHA256
c2420adc84e43e6877e998a4b718dafa30924c39e4ef9bd365ccf911345451a0

SHA512
c1b9d948da33dbecc5234a8b0f307d8af54f7225d55635b36a44e49b6e8c7edcc37a36bd09aa4586e97545157273b3a1eb24de53a80bc7b037a6f3b2e7706291

Download Submit
memory/1044-1-0x00000000020F0000-0x0000000002120000-memory.dmp

Filesize
192KB

Download
memory/1044-42-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/1044-8-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/3276-17-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/3276-10-0x0000000002130000-0x0000000002160000-memory.dmp

Filesize
192KB

Download