hxxps://drive[.]google[.]com/file/d/1di0GVWmcSZSJiPoIkxDHT6a1PumIzM2S/view?usp=sharing

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1di0GVWmcSZSJiPoIkxDHT6a1PumIzM2S/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
10	drive.google.com

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	SteamworksTest.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	SteamworksTest.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "5"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 5200310000000000175914b11000464e41467e3100003c0009000400efbe175910b1175914b12e000000c7350200000009000000000000000000000000000000df58e50066006e00200061006600000016000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000071beae6cd7e4da013be6cc2adde4da014d9ed905a9f5da0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000071beae6cd7e4da01ee1c6cfda8f5da01e46f74fda8f5da0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{996641C5-7182-4C41-9CB1-B186DC32F4CE}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "4"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1972	msedge.exe
1972	msedge.exe
5184	identity_helper.exe
5184	identity_helper.exe
5484	msedge.exe
5484	msedge.exe
2020	msedge.exe
2020	msedge.exe
1672	msedge.exe
1672	msedge.exe
5916	SteamworksTest.exe
5916	SteamworksTest.exe
544	UnityCrashHandler64.exe
544	UnityCrashHandler64.exe
544	UnityCrashHandler64.exe
544	UnityCrashHandler64.exe
3300	SteamworksTest.exe
3300	SteamworksTest.exe
1692	UnityCrashHandler64.exe
1692	UnityCrashHandler64.exe
1692	UnityCrashHandler64.exe
1692	UnityCrashHandler64.exe
4844	SteamworksTest.exe
4844	SteamworksTest.exe
5824	UnityCrashHandler64.exe
5824	UnityCrashHandler64.exe
5824	UnityCrashHandler64.exe
5824	UnityCrashHandler64.exe
1380	SteamworksTest.exe
1380	SteamworksTest.exe
1960	UnityCrashHandler64.exe
1960	UnityCrashHandler64.exe
1960	UnityCrashHandler64.exe
1960	UnityCrashHandler64.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4604	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4604	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
544	UnityCrashHandler64.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
5916	SteamworksTest.exe
3300	SteamworksTest.exe
4844	SteamworksTest.exe
1380	SteamworksTest.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 920	1972	msedge.exe	84
PID 1972 wrote to memory of 920	1972	msedge.exe	84
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 3688	1972	msedge.exe	85
PID 1972 wrote to memory of 1860	1972	msedge.exe	86
PID 1972 wrote to memory of 1860	1972	msedge.exe	86
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87
PID 1972 wrote to memory of 1840	1972	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1di0GVWmcSZSJiPoIkxDHT6a1PumIzM2S/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff925146f8,0x7fff92514708,0x7fff92514718
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3778682399282750730,18177420130029141285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5640

C:\Users\Admin\Desktop\fn af\SteamworksTest.exe
"C:\Users\Admin\Desktop\fn af\SteamworksTest.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5916
- C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
  "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" --attach 5916 2219042803712
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:544
- - C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
    "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" "5916" "2219042803712"
    3⤵
    PID:5028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
"C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe"
1⤵
PID:1700

C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
"C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe"
1⤵
PID:5412

C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
"C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe"
1⤵
PID:552

C:\Users\Admin\Desktop\fn af\SteamworksTest.exe
"C:\Users\Admin\Desktop\fn af\SteamworksTest.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3300
- C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
  "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" --attach 3300 2205899493376
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- - C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
    "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" "3300" "2205899493376"
    3⤵
    PID:636

C:\Users\Admin\Desktop\fn af\SteamworksTest.exe
"C:\Users\Admin\Desktop\fn af\SteamworksTest.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4844
- C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
  "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" --attach 4844 2788992225280
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5824
- - C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
    "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" "4844" "2788992225280"
    3⤵
    PID:5820

C:\Users\Admin\Desktop\fn af\SteamworksTest.exe
"C:\Users\Admin\Desktop\fn af\SteamworksTest.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1380
- C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
  "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" --attach 1380 2102577336320
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- - C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe
    "C:\Users\Admin\Desktop\fn af\UnityCrashHandler64.exe" "1380" "2102577336320"
    3⤵
    PID:5636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\DefaultCompany\SteamworksTest\Player.log

Filesize
20KB

MD5
f20e46c3de2f7941a733009ef8f39ff4

SHA1
2a4842e3f742f7b8eb3958f96e2b597d2733e6d4

SHA256
a740a69ead418eeaba077203afe66bc82b8ff7cfb00014db9836c86acae2e67b

SHA512
700d0ea895ecc48760bfc012c28b7f7174fcc081f0fecd3a87d9ea6bc55a51aa11a474b9c73314943574f49d8a670084379c653c12cfadf98697cfb97830a93b

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\SteamworksTest\Player.log

Filesize
21KB

MD5
8f7639f5896eecc0c3ac51d9788c177f

SHA1
488f20d6a4bb875153e985fbb022d60123fea5f2

SHA256
fb99c1b6379ebeb229f69d7aa72ea6d2dfe4d4340e19658ff51aadf1c48a98a9

SHA512
56c262512e6670cd33b52a1333467b090da35f0f280299003056bfb81f92200c4cc1d6d218c66d50c10a3f4339983566e4aa42ed345b2f6abce43bb54c3b5c06

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\SteamworksTest\Player.log

Filesize
20KB

MD5
772b9f720424db1d6d6273a3b9fd941b

SHA1
70c071e05a4c92bf46bb270cb10b1b3e16977eb9

SHA256
d92439b239fb808c1ff75a59cb5ddb1d01a7be339ab5a7f1089406a5d8f9bcc1

SHA512
9fcf5efb91a4b4e403e2d3671c1aec8134a701729386da763b14b483120d65e1c52c6e586657629c5363bd6a24eacd90d93562f6bd4bb7f6cd4be4f1ad034636

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\SteamworksTest\Player.log

Filesize
20KB

MD5
ffcaed16fbe9f64893913b7d391308a0

SHA1
338db7010903979cc5dd8d36f3ec060c37de0519

SHA256
1a8dd4288a944ed16b4fd2e1fc732431750ba81f279fa6d3f187dcb09ec49269

SHA512
2d12ba6dc4acf99875df6a7f453ede9ab20f852c5cda3f5d6020cf86fc8c7206d2f6827c306b0f383b0e6899cf0b6cd15222098bacccc28a146832d04b908a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\DefaultCompany\SteamworksTest\data\profile.json

Filesize
197B

MD5
74138ed73fc88f4dc480a02a53ecb534

SHA1
7883ddc3f7710e352e6bc146d8661bb1a3977ef1

SHA256
7fbc8644cb30385c43b53da0c52d95bb3d92d77f655653f31a1b5846875662d6

SHA512
24e3a8af7673c48ba04e49eef3448dd1270853de31a59aba6ee5f40be835a8d36b280668cf10f017da4208a011e3f2574b77f057249115d6bb62b42c68fbdbb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f60e2f6adb6460ae1601574207284b56

SHA1
143b25a243b8b6afec6644b2faf438a7694e866d

SHA256
1086f1a69048e77e5523ca943cefc9c9801da59e86c1d8439f0d53aeb78bb681

SHA512
ca2b57dd599e37be66a2c2f0e631751ff658084536bcb21f11f5ea2a285c235ef0c9d3f210c3ed082b3f14255f8e5c64760763cba3e68a2451f063c764eae800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
90d177b7dda8f917330fafd06852eb7e

SHA1
bc83efc7b56fcd0ed3b399a8d580cbc01f38c240

SHA256
9857b0f4723c390e1f020040f2ec6321f68763064dda7cc8f158d08b83497a2a

SHA512
03ed257f4e4d2eecad34b8da43d10ed7d206a93c825fbcd6f7675b84f452d756c855ff17d5352aa4c8c42f4e4a183c554278e3348acc031beaf5a8f095ed6aa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
7785bc2cf6196e8a7bb44dbca570dbf6

SHA1
7693a513dc7ed4725a1db3f8947548482447a59b

SHA256
e5b2364f003a94d2766e3ebcd6202d8279c23699d00393c7dce0da5c80ac2820

SHA512
0dece2228e888be0eb3efa11751eb4a5345aff181c8225ccee963c250db09aa3ed557d8d9e7514f42f6c494d66d30f304dffc29ba1af44e1b9d7777c89904010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
8361c17a5da48c0ea3c61793d7256503

SHA1
e83aa8ef38fd3c06962601cd2366341c46ff9802

SHA256
6e8ea622f104d3670066523c5650391ba2e2b5e0f49a45a62021dc3d5239c9a6

SHA512
cc62bf1f530f7f32029027f31bcf703dd5d0d925eb2353ab96b8b828a1c34930140e154a4cb021a85dea9ef6e37b3a574cae8fd16497d59775c7fea8f1e0fada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94b1e9ecf92b3189b32a4a61a3985383

SHA1
feb072f39cb522033ffba8df9c3e4521739a3001

SHA256
5ea28b1d1999ccbb68d85bff781ba8815444fcced1e9845e713f33f52595d26c

SHA512
9126ea8245c26e11e4fe73decb05919115bf0b1e7d0015e17e9d800400de545aba9cf431a7a0529379983702bfd0b540a6ddd3e5661f3512739500987ec520ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b9a2978f909093ec005491065a9a6495

SHA1
0291c30823dd9c10f8b52673393e4e1e7bb16ea9

SHA256
122cd191496ac2100a4f1b95f5a5bc6bb78f07f77c6126a7a5ba56a839d89c32

SHA512
849229159e0ea15dfc626528f47ddefd2646ce05425e515ca0521efe599da50a030843dedb92031a24b0329ff5eee5aa3f31cea9969dae6bb1c913f0030a9d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
407509f19db43a8cf2fe349462ca403f

SHA1
851b60322ab6e4ef5c613202b42cf0b443056c88

SHA256
94c91767970ec53f983f8f6a72e500ce32dd872f754d0f31a2997743a22eab32

SHA512
d224ef030ca5acbde7b56620e1035e3e3240d8492066d9db06691156f04253615b2230f01d1b34296fb24165a871a38d30413bfab8b661866f1611f86af880bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a49c5ef2e72b87b21b909489d4e5f80d

SHA1
9d9b2765d85d1f2b6a74dd45de514b39f25646b6

SHA256
91de687e55fe67a75b96390f5673bfc0b26f53dd7481c650098b7fe15d3ee45d

SHA512
d60a911bbfb96c83cecf05f71e3f33ebd54ae0bbf97a3d4ac9d1e215b4b77d7372b118c34297c1055ffe6606bf72f85805f77ae2f1080d6424706dadaf383d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f2fe15bbec9ff4d98f1118c309f4050

SHA1
0c28acbc006a6f5845bb77db5025ad26db3107ad

SHA256
c2b4db3e8182240446457202cee47e45f6b4562a3cfa3fb0a8bfe12a3c471a0b

SHA512
67e2c62ebbc9279538ede8318ab0f93bf13600ed6d5d4fa9e53a562230342128e20020c23f05d53140140bdd68b0aa6472833c8127c59bcdd203ee1a360b2822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
373572d115711ff6dab0016dbf6b7257

SHA1
86e69a0f4becdf1877413c57731e63d846549b34

SHA256
2db0aa95191753981c7fa6088104403255c8473c9ef634265e8e6d9cf586a05e

SHA512
84260524ccb753180e135176b7ef5032e8f105dc9985099e4ee7fb640c3a162be2b32da19a4f07044eb85bb1ba418ffc5f0e9b356c2ad7b98a805da0e7db3e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bd9e.TMP

Filesize
48B

MD5
8be17e30c99a2f51ed5f11ed7ad6f0ac

SHA1
1c8b8f745c37b36f5ffe929f252a1af37219b7f3

SHA256
4a73155012a266708ea251254aeba628ff9e81e2feae1d6021e9ff52a689cb9d

SHA512
d84441905dc907f8f23cfc95664d132b931b86823dd37e4d9d73a8bb73e25ff8964e71dd53f3064655cce8473143f75ef2cdeb7b77d75058ecf3a0a3be3b11b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27269640c1dd7822ee7b25e2c969021a

SHA1
9847b11ba9fab08b74f404096dcced34c12a221d

SHA256
36e71cb42d490d834f95c1f16404f3e0c32db1a6a05d4b7febdc0f552be948f9

SHA512
48e382799f45419767514e41ae3b9f039536efe1b5a1f998c90ac0aa80b0dc5dd6968597f1e35ec16c3cb7e4660b34b9a0b182a423773e9ef66c673782edb740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
11db354e1a7243134ec190157d6d3fcf

SHA1
4a0f53e59f1c24032cad79a4c29c2117ab9f7283

SHA256
5eb59652bc2b31448ffdb98932d12427c7efae6a560046b54330cfa5f5ed9587

SHA512
49c0edbc9fc3eeaab08bb13e033cd302720745d77604f70111595d48ad994ff01234819a6e7e6ab84fb7ab89ae2e57ecbe19078e960beaebb3dd6f9db3486412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583208.TMP

Filesize
1KB

MD5
ad6fd382a96c53bbcd2341d80e2d718d

SHA1
6988e06ce70da15b6c5efe22e5cc41dcd89c0ad5

SHA256
657aa7a7b38a140187352643f2b7315f169decc3874778d33966c4059d3ac294

SHA512
bceee48a9c82f1d0c26112a8e0e3f3b88d9aeeeb67c3254dc14378416c96d0692a3c9b07ad9e60a535a3701f8f6390a09197892418f10d836bdef7f8893ba634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
07a863de540f9b25a6d7ce636d603797

SHA1
77360c063ee61adb0b317793ac1ea17cde46b824

SHA256
49f19104c03e1e11ce676834b31c657d19a71cd9752047be29d3dec2a58e2e29

SHA512
4a204ca8ccfb325f0b75a8bd5775abad23171a92b766526872e74c3e1b550027eb3daf8297a97dee201a9621b06fa82e47291f6116b90d79f8ddad6b17373df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
75b4aafd3a4faf1792384ceeff984ece

SHA1
4cad837d530f8dd4613ed2754d4370a907fddc98

SHA256
bf84b61f53344c1bb0a75128c718cb74b898cf7ccbe20009ec90141ee0830b5e

SHA512
e7ba3c7006afdd43ea6f6193177170742fcc21a02123c535c942f3349ab111b04338d28e5d4efd15e6af0fd9dd1384ca5ed73622cd2580574cd9805066a1cfd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d391367da9259dba05178e902e887a96

SHA1
394fca074869c623ca88aa9c8d75f21737fb2f43

SHA256
59e2bbbde56268881ef39c5b97c16916ac7d6754d9a33c8ecf1da9014a01f6a3

SHA512
03133c46321d1770fa1867ebec82ca33b21da67c664bfe5cc398fa76cbe90c4ec6b7d8da55469d207186f6607dc2ba412471fd80e96b2c32d45b0f6386062ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
28KB

MD5
1f64c2a0bcacd3fa6b7dc1a113d0b06d

SHA1
6e6b84314edd2d20d13b9dd7eb7414094ba5d5d5

SHA256
9e65640df037e52dd7cc8f9248d1132b8545313510e6fc371d393f7b9061e434

SHA512
6c9bb7d0ed8532fcd82bf0609de99f2fe7e6efdd0ac039d6669531f6f63d6f64d77a122c8c6c59ea94c4e2490000870a562a6cf3a94c868dbceaa60b4791f296

Download Submit