hxxps://cdn[.]discordapp[.]com/attachments/1263713360332066868/1273062725894803546/Release[.]7z?ex=66bd3f8e&is=66bbee0e&hm=ab5f3ad72b570e01f8bb0af7306a17817706f8f75ac2e2a21d5c2cf721cfb8d8&

Analysis

max time kernel
103s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1263713360332066868/1273062725894803546/Release.7z?ex=66bd3f8e&is=66bbee0e&hm=ab5f3ad72b570e01f8bb0af7306a17817706f8f75ac2e2a21d5c2cf721cfb8d8&

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
320	worldssillysfile.exe
1820	worldssillysfile.exe
1304	worldssillysfile.exe
4852	worldssillysfile.exe
5084	worldssillysfile.exe
5392	worldssillysfile.exe
4824	worldssillysfile.exe
5172	worldssillysfile.exe
2656	worldssillysfile.exe
5608	worldssillysfile.exe
3696	worldssillysfile.exe
1864	worldssillysfile.exe
2264	worldssillysfile.exe
5628	worldssillysfile.exe
696	worldssillysfile.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 15 IoCs

pid	pid_target	Process	procid_target
3608	320	WerFault.exe	123
2804	1820	WerFault.exe	135
548	1304	WerFault.exe	161
1632	4852	WerFault.exe	164
3000	5084	WerFault.exe	167
5196	5392	WerFault.exe	170
4968	4824	WerFault.exe	173
5532	5172	WerFault.exe	176
5284	2656	WerFault.exe	179
2368	5608	WerFault.exe	182
2552	3696	WerFault.exe	185
5764	1864	WerFault.exe	188
5280	2264	WerFault.exe	191
5808	5628	WerFault.exe	194
4408	696	WerFault.exe	197

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worldssillysfile.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133680659192352702"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{DE0E21FE-9681-4FAD-9082-BFFA968CA8DC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{A1C4887C-D2DA-4BEC-AE01-C311A662A8BA}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	4520	7zG.exe
Token: 35	4520	7zG.exe
Token: SeSecurityPrivilege	4520	7zG.exe
Token: SeSecurityPrivilege	4520	7zG.exe
Token: SeDebugPrivilege	1164	taskmgr.exe
Token: SeSystemProfilePrivilege	1164	taskmgr.exe
Token: SeCreateGlobalPrivilege	1164	taskmgr.exe
Token: 33	1164	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1164	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4520	7zG.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2316	4304	msedge.exe	108
PID 4304 wrote to memory of 2316	4304	msedge.exe	108
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 400	4304	msedge.exe	110
PID 4304 wrote to memory of 2492	4304	msedge.exe	111
PID 4304 wrote to memory of 2492	4304	msedge.exe	111
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112
PID 4304 wrote to memory of 3120	4304	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1263713360332066868/1273062725894803546/Release.7z?ex=66bd3f8e&is=66bbee0e&hm=ab5f3ad72b570e01f8bb0af7306a17817706f8f75ac2e2a21d5c2cf721cfb8d8&
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4104,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
1⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4208,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=1336 /prefetch:1
1⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5400,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5440,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
1⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6008,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
1⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6088,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
1⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6460,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
1⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6704,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
1⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff830aad198,0x7ff830aad1a4,0x7ff830aad1b0
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2860,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1944,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:3
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2252,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4544,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4544,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4576,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4572,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2460,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4964,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4968,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5196,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --field-trial-handle=5656,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --field-trial-handle=5664,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=6104,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6300,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5352,i,9853367777784937225,12253221735055419152,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x21c,0x254,0x7ff830aad198,0x7ff830aad1a4,0x7ff830aad1b0
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2248,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1876,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:3
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2076,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=4148,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=4148,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4208,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4268,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4412,i,16692126614140334300,3442167634638194574,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:2380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3904

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Release\" -spe -an -ai#7zMap16653:74:7zEvent10415
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4520

C:\Users\Admin\Desktop\Release\worldssillysfile.exe
"C:\Users\Admin\Desktop\Release\worldssillysfile.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 932
  2⤵
  - Program crash
  PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 320 -ip 320
1⤵
PID:3044

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1164

C:\Users\Admin\Desktop\Release\worldssillysfile.exe
"C:\Users\Admin\Desktop\Release\worldssillysfile.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 896
  2⤵
  - Program crash
  PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1820 -ip 1820
1⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cmde/
1⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:1612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3948
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 868
    3⤵
    - Program crash
    PID:548
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 908
    3⤵
    - Program crash
    PID:1632
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 908
    3⤵
    - Program crash
    PID:3000
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 908
    3⤵
    - Program crash
    PID:5196
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 908
    3⤵
    - Program crash
    PID:4968
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 908
    3⤵
    - Program crash
    PID:5532
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 908
    3⤵
    - Program crash
    PID:5284
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 908
    3⤵
    - Program crash
    PID:2368
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 908
    3⤵
    - Program crash
    PID:2552
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 908
    3⤵
    - Program crash
    PID:5764
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 908
    3⤵
    - Program crash
    PID:5280
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 908
    3⤵
    - Program crash
    PID:5808
- C:\Users\Admin\Desktop\Release\worldssillysfile.exe
  worldssillysfile.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 908
    3⤵
    - Program crash
    PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1304 -ip 1304
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4852 -ip 4852
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5084 -ip 5084
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5392 -ip 5392
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4824 -ip 4824
1⤵
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5172 -ip 5172
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2656 -ip 2656
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5608 -ip 5608
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3696 -ip 3696
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1864 -ip 1864
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2264 -ip 2264
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5628 -ip 5628
1⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 696 -ip 696
1⤵
PID:5832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
cfab81b800edabacbf6cb61aa78d5258

SHA1
2730d4da1be7238d701dc84eb708a064b8d1cf27

SHA256
452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f

SHA512
ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
39e3161ecfa0f4cecaad2304571d761a

SHA1
6f18facc9d0cce37d13002808fd89b2b7ddb8a02

SHA256
d9f101852109863e821a5448d61603e3c782b33f5c5a06dc760021ddf2102611

SHA512
63cdb2fc55b200cc1bc8b4f5568bf00534935ff7fa2bb0937f775eb8f8a3b60bb49713c6a09f38e0554f9cc353b592f3e653f3fc47787595f6ff9877f5a57c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e177487-26b6-4235-95b9-1cbf411b4a66.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
2d6e8baa2d5fb8ee621b42715e689d5d

SHA1
b07e25673988b663a0084a16bff59bfdfd3b1a4a

SHA256
4ecd7d416528b4e24bfd6d35ebfdf0ecc43d51e06aec0be1433d183068320215

SHA512
1c24b9114107ae329f38ff6e8f855db9a7907afe66789311714ad4d8c8aed2902bd45a2ce4b6a0a52a4d5447fa5e303a4046cfe24c115c925aee0d291af87d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
86f4340d0199cfe3647d34082236d13b

SHA1
b9c851e7809dee60c83bfc1eff9eba2c81505bd5

SHA256
16ccb56f3917219e4d396933c6f23fdf58ede6ab86bd2d9213d11cd4c8f25bd3

SHA512
378c0daa43c730b4df373335853fb1476f462f5e05644744527c44d0e29d4baa77c3185a0fb792030c44b823e9093d00c875d32741976dfe35808b7e6f63245c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
126aa7230588ab30019481dcbad6e3b6

SHA1
8ecea04dc216710446a90efaa92e263d54488f9d

SHA256
9f050bf92e43e0285294a7511c736b69803761a54751442762dd6e899cd33586

SHA512
829a1aa98bb354b5d20af4a1a06d034a060b4d7572165657423f368eadcdd8e77300e7a25ed315e4d39c13d33d2d0bd3c892b3309039cdeee8989fcee852e88d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
12f94a583160fda363e377924e8b2088

SHA1
186d7ea72361f58dba6846f8ea5d432078429615

SHA256
f504ec5785bc80d35cb25232633cf1302235bd92c7f02c0694ad0b0e03c725b8

SHA512
661d388606049af89fd6c6f0c0b7b2326e56a283dff6fce00d4c782f34017d2d822749ffb527bdf925fd57cef380a3937c11f0bd1878c510481ff0c6c65b4dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000002

Filesize
54KB

MD5
4bd96baf1b35ac34813a033ad2fa65fc

SHA1
3c9d816cd4260e7b1fea30a2ea1e2edaefe3841f

SHA256
5bfafb6104f8510da3baadeb7744412629e058906bf11478a7ab58f62bede226

SHA512
a6c90d553c83c8b5dbd59ab3aa7d9f989574066c31a25a7db3383f31cfbdb71326b33351865612cf0c9487301302c59d03cf7f4e86351e3ab6573ab2b7dd8539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000003

Filesize
21KB

MD5
fa16148d44bf8b041138f564fe55c02d

SHA1
ca00280856cc29a928c8a3d2e43f22cade2f3a07

SHA256
5f6a1e303e87b3aa4ad0d1fbc5221523bad39cb2e88ca56897ea8e4e298f9351

SHA512
64000d43c2955ca3e72607b4294debd2b21be867d66709718c3b4e5be22148ccd26548749dc574ff8f8a5720637afc6dc38d1184c691ca35c5ee9c418c7858fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000004

Filesize
122KB

MD5
5736b5323893dc638a85d7fa2410699f

SHA1
51a8b3a9c28a28d20855d454a3470ce833ebb7bb

SHA256
d7eeb14a802fb5ee85dbc968e5138eb6206dc69330a2e1f5e0daf052f7f7f8b8

SHA512
02c1940f0c94c5c53b783e905935bbf9abab6eab56828e30e9c953f0d3bb054c5e4ddade194c513decbbf189a7062d17e2913a0dec70eaa68adadb82f62096ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000005

Filesize
29KB

MD5
b79c1ab17ea523192c4904bd25a0dba6

SHA1
fe3eb7086359a3b0c9c257a699617ea64c4cde4e

SHA256
6a77d6ea63d9280b620d283395fda5e313ef0729dcd1eff8d934e3c5ec4f1050

SHA512
38813c9a2b5fa8abe4f7e7708f73073649c775c8240e881709e7471a036ddf99caee69a8589cc2e500e47fb622d8165629e26db92882aad3c793bf8d255cca8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000006

Filesize
33KB

MD5
40f8e7db46a4c8a0437c63f40b08db9b

SHA1
5cdb490818fd4b16a4c76be7f88499eaccb5fc90

SHA256
d3768179188a218aaab384e8a2efa4aa4adcbfdfcf88f7ad40f2500915338956

SHA512
26ad28acb871c666bc8f30384b7a8772e5bc6b16930f61e3bbd8fee360bddb982bbfc3c2d844504816d5c3e55bdccdb95f1227f4acfc55dd3652b020dfcbad6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c7843a5abbd360bca6b26ac704596ea1

SHA1
abb888445cb5c99f5f6939df7e5bbf043faa5ac1

SHA256
64822052e3f30297fad74e649d8ae27ad7acdfb27fde328a72cc7e2411b8bff1

SHA512
f632ea3be37079fe5be9846986df28c2e7b7eca99757e65eff0e7602be6d2fd4b0d8a3c19d2d12070da160f8c2d2f360e766859ab1409418b2b92a193eaabf5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
6f6ba673817a40048a7cb30dece6bc14

SHA1
8c6d89285a026c020d078e90e1ce8eb7f349e974

SHA256
ab8c6606aa6a6c4f0f91fdd91fc9f2da97218974d41aabcabf15a1fa6cddf05c

SHA512
a2887ccd356df65953918d173bde6cc6cc3cbc226c4c05ce14db7ccecf1cc7e564d4a141ae86407dd07651ccf09ab55e0ce36580f4a9a053d6277e0b02d91ca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
d873746b661ef48db09b767400888909

SHA1
267e86cb44cd1d1d7b8b00db8051b14a241e2022

SHA256
ff07a53c3eb9ebef4383636014ea277ba80cec881721023e25ef959a093e09c0

SHA512
a22fb6e73ad12a4d3992eb223e9a59fdf3a90c2313785c0c1401790c2b470bcc00d28224fa1467a19f032e7849a15ef271739ac640e395daf82e8c11c25f1795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
fae59defee6d82fc77bc039f9e4738d4

SHA1
0370d90346fd1883134a55d6273ba3987c2d4e97

SHA256
c14f691843479d018ac290c3f19e1163e37bb314c88fdb1f0d92e6f4d0ba5a91

SHA512
de85e90588fc225a6dd56d4b4fa343f287193549e89178196d2a7bd127e67609514de2948521bb33bb99b93ca249c284713a9993e9cedb8e45f0a41d200f9d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\62816266-f139-4934-896e-1db800dbcb7b.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
652e549411cc247c76856080d05c8bc7

SHA1
8ab5d8942e65375cdc5ef0dcbbd1724cf2ee63b4

SHA256
92f2461f9620c0814fd0e4c80742660bb06db1380552c71ac45a4ca17d433d4c

SHA512
33440cf036e6deb1493dc650a4c61b90236e4fdd2da5fcff3ae90c8fa2e6c1d8e11dd3484d9a55be3af50b874b848689325bfbbb78779e062aa160b06c239ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9fd892a19fedc5008c5cd4a2c6115fb7

SHA1
27f0b59157cbaae63b53a2a81885e78eb32c9469

SHA256
a0d77dbfc9dd9954d16680a157b9bcc4fde3be6afe231a3336f43de5b393795f

SHA512
61cb4c8ced18308801ac6a150633f17d797f2a9c75f860d937776345726b6c51aab9be168dbd8965da365352ce1404c396143dd7d69c8cea06372fbb9403ca01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
3b178955e8cf4bfe976df4817394f908

SHA1
19c6e16fe1d63769af9306a0e52ceb57b126f181

SHA256
4daa287933c2a3fac7d485293c9a1f2e72111e6e9ea36a99aae574f8cba290c1

SHA512
5b84cc9bc60164e2a4666a56175f8800a26bb55ad25832f99dac544754079b46496a9593cfa24acbf93ac72fd0c5a4d76784fc1139478d6586ace820e55ce169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
94b3cf13b36046eb6a7bd4d1b834bdbf

SHA1
cb1befb1a85a5bbc0bfcaa7486eef87d41f12703

SHA256
529ee00e9275d82262347724c0b35e1c6cc5d5daa000e797012306445f7239db

SHA512
9232b5800cc51094975f2c517defe0e4b7829f14452df3d835085aa432892723323b5b9064ea07bc01064e79791b3fccb5db12618b731f7a350b386282e6fce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Filesize
20KB

MD5
d0a9ed1f2f45650e74aacc8113da725f

SHA1
b5553e00525d2605f1533fe0d6e2c8465dc62b03

SHA256
34dcd618c798182a9c6eb1946b594008f771242be9569e12bd0f5f042463c0f9

SHA512
1543c69cd22a59fa47db8028e7cf81a750a40912585bf3ee70179bad719d07aeeaf512f6dab3e4aa653d78baabf311b2f7e89562a820a07814b6c08ffce5a9c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1fca6fb0732a3fe623b07774508db465

SHA1
060f126f281946798b46bc9b43e27713f4d82f32

SHA256
359836c664d6ad007081da7ed3aaef3b1a4a253e6959ab6a5eae8d43d57c28dc

SHA512
2eb0f56372a3728030f921e86221240505280299ad54cacd2fb5353389c96874846186d2448afc1e328fe37d5feb39e58d2eb9ef0e8fa7e35fb5a9d695e89317

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
93cb72a3cac4331c9ce61e91d8190ba3

SHA1
064248fd4d218dff6a0f505a9547f4d4abe021a1

SHA256
5e81158003c7984d3f847579a0c33c5cc69e51a2055a7dc58ffda3fc3193d8f6

SHA512
29f8011210b1baf65bddd4eafd69cf598de4255704c259be83da3461d5cbcc80a07942697cdf2581b2414a3144cae7c8eed5836e7421858a1516511cec4fa9d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
9222261bccbd5189dab71da8d60b753d

SHA1
6405cb918929f5992aa3a624916525f7584dc334

SHA256
9104a3154d629880e375e9890757c0c4e6a9840eeb99190d85d8382eadc4b2df

SHA512
55e4f2c5f01527052d0c866748a6b4bfab5bc0505f1ecf1ec6b2fa2de3561b04783594f0cbb1842f34d83f5a45f15bcaec995e756566d8ad52c4ed8a7c64e7f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
b819e2000fe10d2b07dcf99e4c0898d3

SHA1
8f54802443a73077f5574d756aed2075ff9decd2

SHA256
64345355901d39faa2467b68c4099b97302ee8429387dcbbf092f14a414f1531

SHA512
e8a5f318f062453492e3717c235a11df122f0d34c7acfc93a53a33056873fccb73c30bd054ee8c5e022f2c8f93fbcd764dd131a29eaedd90160d5ee03181e36d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
ea1d6ec5d0221bff0eae231f8da9a367

SHA1
fad7f4c83008ef40bdff8168077ccede24169f1b

SHA256
67840032682ab636ad8b0f2bb92c534915da3295296904dc5ba57bb331a9d197

SHA512
7dfa432321f8d0d5554e08db800e8442f3b7ae8fa8e379aa29df671cb4d21a14a4d0c588336f91bc36a3c2f287252e60bcbd67830880e0281d2b44fa36c704c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
8c366ef70419171819abb7d5ce91174f

SHA1
cf5892e5329452bceb7413726cf17e568ff619b6

SHA256
e00fd82c28a4ce82b8d7037c4ad765c160819f7fc865e093261ed7befd036890

SHA512
70e1049db5f3702248ca02b1c63da295a13e129a705008393c728ba1478d46f318194cc9531187936714bfce856a7603be50abf56cce3943abede9c426bf621f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
2cd01c74b2356dba69f04bd857ab5680

SHA1
22c619e2a0b5aea143d8681efbf423d6538fd0d6

SHA256
1ec144f403a31e2961572188cf79f9448872d0d516cb5e4e87aaee325fbbe3da

SHA512
98cc975aff06423cbc072e7503e59f38ba08eebddc375ac6bc512b452e4379aaae3a187617b8213e1c5303ea0565bfad95e11ce573b31ac37d29f4cada0da4a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
3167835cb72bb27406a9eeac6507677e

SHA1
434e80d8a36dc0bb7b970d6c7ed59ee5ab73a5e7

SHA256
c680549dda39e5212280b13a4ca47b850fdd56eef22f2dafcc39ea8faec77d99

SHA512
19ffc104d06b13fc17231d2cb2e1b59b0fb757c3cc221d85293d9e3f1a6b34e1b4578e423746354d9caacc4851eb40084d588f88d449c1b42a0387dd33fd8247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Vpn Tokens

Filesize
28KB

MD5
2ab963a9d95973b9b2a2726616127e17

SHA1
8da5503720ffe3f1a928ed13ced1deafc4940388

SHA256
be64bb3000369aae846965ee2ee80b8a6bd1067137434daab66ac5caebf86413

SHA512
0f8b03998abce721d8baf0a3a6e02e1fad2dc0b6b5647f32d0d3a8e2ae64fd69279638eed892574fe7d0eccf9fe094772fce494b9203871c3b300e1793a2d7cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
232KB

MD5
e5c6d308c4a2bd69dc1c24231958c9e2

SHA1
d1ae9031e7f657a200b2421f3ec44089c2ce9c51

SHA256
b7eb3aae0e1f6f88fd90aee7ffaf2a1ccffb4ddb8f68ce6514efff43f3c0cccf

SHA512
68f2efe50afc198c61fb35fe917268b2d442cdc0d1f3ccc016fa04c9331fbafe46b996b3f1f52c77befe50c061a5af2fbc3ee4d7bd0dd495249b4d7c9f61ab9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
11KB

MD5
59c4f296bd9cdf96f7481653449c1512

SHA1
f230ad6c3ec3c50d8ce9741e26aa21c871c7710f

SHA256
122ecb5bc96aa21a7d578900eb24e87239fcb05e2e23359401bb04133d5a998e

SHA512
7108ae46cad3840b311a3bfba88ad981db2524d77552317d71a45857f5fefbd3d6fc0d99dae5b18f7e0435566021f289f14a4808b183b4ed10a66951e1bebe48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
9KB

MD5
d80e83665c324f00e3cbfb403234d727

SHA1
511ba1cbbfa114861161cde64e244a0ad9b03bad

SHA256
865249721206ac6a97269695545a889f25b185f66251ac8626edd5ba06d33c53

SHA512
dda2ec5f183e6580792891b2b985491724d54831a1dc745233b6b048cd36ad654a8673af182ff5502b524fbf28696065586e098d25dd0ebb1cc76d0551f0e8e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
3bc57c5757acccf553847a02bb69a845

SHA1
c1348877841f9512c5f407a66c3ee2e56e9cc196

SHA256
a9f062a534ac36d3b9f8bea143263a8013e05bc914d538e23184f58255fda59c

SHA512
bf2432768650761347debadf8d09fc55d3935728bdfdb66aabd3b0cc80200ce2df2040858e7fd9a13f9c67d7ad0a19bb25521550ef65a47a0f0503dc64f7b281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
922B

MD5
060f98f4c254bdcb5542f58c18757229

SHA1
1bd84211ede962696f578cdf6d48a4e2bb7bb7bc

SHA256
8520f5bbbd7c92e0a947c2fdb195f4109f15c6af2fcf8a6bdf555b0254fe1c5f

SHA512
e5e480436565392914edc01adcc3e30b60d419390ad844a7906c2af7b2c0bc945917995df1f872eea3f1f90ed4ec79f68cd83f4780c1a2d6c390a549f38ffaa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
4778d8c4d58f0d89446c9338eb13c02a

SHA1
06f24c5035be537b4db02e08c01d6a70b3edfc65

SHA256
a875aaaefa7648eafecaffccff204ca8ff475f69bf3454e0488225501a3835f5

SHA512
ccdb16bb11b52c395124959024be70f10bb04f3f18bf22b1b9ade7de5bdb70f7f5fd45586659db908e609f7606c37a08d42c35bf7140ba6f3644dff165884d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
59301de32f7ccb0220d633d46c346851

SHA1
ed2d2493d7d9844b0c2a532aa0a6b0428be44f08

SHA256
abc326a89422e1d6888e30089fd40a3674af467393d0192ed9d9e65a5cf945af

SHA512
942a22181b4085a671c299d26a3f4900e718c40fd6c5bf497b391205f2cda14dd8bcdc415b6523e5d4464bec4fb10f82b1303d337fae232ff7cb8c36ccd2cb9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
82a3b1c329a7a7887424d7b5f2f7812b

SHA1
c4801f35d847f97db603150c3710a0cf161eceff

SHA256
07666022f65543e0f1a5f3c154ed55e48f603f1d465f38b4af0bba64be1a5f05

SHA512
3b67154a83e0b0fcc7d8837423e901a7c7d6fa9465de9c55ed65984f079d16c42371c8dedf935635b19946d73b6db8d6de99b3bd3d525e46882de23d4653a3c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
a6d2e0e684e5debab8ce6b45d699e723

SHA1
fe970ddf00a059559c233bbb74496e91947ea592

SHA256
9656abc81783974a80bb54871d03d4ad026e64f99c73178886cbc42696d8e4ac

SHA512
9517bab30a8609b49aa4dde56f67fffebcaa4d98be9b3c18729ebce466056df8e41a34d986f5df9b0ed28807f47dba29541127739c74682ce14279ae5f3d403c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
20ebd14f0c44c56fbca6d7887a82bd6c

SHA1
baadc9f66fc3948f0fd227ef14927269bd78c61e

SHA256
0558e864f7ad8e67049b77dd1d415bc49a3ce383a5b529617ed6aeada9d76eb3

SHA512
bb0000c4a553fa2bc3138c67490d30779e4a5d4758af7cf6927f8a0479abc2a6cbfc93f1de8c0c8bc0a8b40f79f02a2eabe689fb544d7d0e6afe5ad60f453bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
53KB

MD5
708bb3e0c87b2f4320afbb4c4dd5b6bb

SHA1
75ab5fc01c5d93a8ae41a29fb43f1130e857480b

SHA256
2e7745128ba589ecd9e54eccbbc24994e81e5d30ac7acb5b772d948279fb585a

SHA512
b634e2244cd1f5e5e0f0a275a4273cec403e881fb7f70efde3fe4f720da15ea3f9006c41f1626f7b32d84c523dd8f63d7fe13690bbc89145b96e8caf57106369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
d3b78f044cf5e7173f33bccf44881468

SHA1
812523e9c71b3dc77f605fc5cdeeb43972854fe5

SHA256
f295714fae4d8a6a779173efdf03bd407b3e12f01735415675bf5f637fc2a483

SHA512
0e945e74e06a679792d17fd530aed1be9e96b09e56ebed86aa901d0324944eca715d9e5bf0fe27e5351a81b3fef6c89e017f8e977b55656f2c856b0221a70ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Filesize
9B

MD5
b6f7a6b03164d4bf8e3531a5cf721d30

SHA1
a2134120d4712c7c629cdceef9de6d6e48ca13fa

SHA256
3d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39

SHA512
4b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\Desktop\Release\worldssillysfile.exe

Filesize
16KB

MD5
bb7641ad1ebd664bec8b29d7227234b8

SHA1
9f937758a9d327d0019d32ee7dc109d5f3fceeac

SHA256
6199c2009af2e3d3330b9e7a5e7fbdb02f6007bfffd5b941ada390d18fabd780

SHA512
7251298e2d8a67406ab8a0e124ea980687a0a6eaaebbd49a57118a0e063dc8da4623c829b3403ce78fc5523dcb5c93f606c0690cda529cd9a71e01addce28625

Download Submit
C:\Users\Admin\Desktop\Release\worldssillysfile.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\Desktop\Release\worldssillysfile.pdb

Filesize
41KB

MD5
3b9f2722a1d168aebcb99df4400beb23

SHA1
97c4e149bc812605a91d29b3338d7b33f4d331eb

SHA256
42dba2e3efb6bac3dc628b4a5f8824c65dcb926a7830c2cfb929d246c115bad5

SHA512
cf222c1a283ee3fc7808f7faa5058cdb4d0d4fbd0917ad256bdff377e39bf4da4319b954747b965f46fb65540260688e56710635afd05d8baedb870835909d8a

Download Submit
memory/320-110-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

Filesize
40KB

Download
memory/320-111-0x0000000005680000-0x0000000005712000-memory.dmp

Filesize
584KB

Download
memory/320-112-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/1164-132-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-124-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-123-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-125-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-129-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-135-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-134-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-133-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-131-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download
memory/1164-130-0x0000025CBB3E0000-0x0000025CBB3E1000-memory.dmp

Filesize
4KB

Download