fca0b7e42b11a7e326882edac09a5407319d89c0c223d061c6700789fdc75b55

Analysis

max time kernel
626s
max time network
626s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3bbcb1b523bb75482d2c2a3c6976483d.png
Size

16KB
MD5

79b7f3fc1cbcb471c7b687dbb6a70267
SHA1

c56c45a191fad0a08d39b305254785a6820911f2
SHA256

fca0b7e42b11a7e326882edac09a5407319d89c0c223d061c6700789fdc75b55
SHA512

e2e98f12c03978b8751bd45ee7729d3c5e868660f10c61a0fb6a56e9532f4a000d0fa43446aab8eba5e92bb7f53a0e906cca9d39451de3a18152d619c36414fc
SSDEEP

384:u/U9rZrBuCTW9+0b3whupoLcWnTz3uPbTtnHle0cL/PdQjw0FWYE5Ds4n:u/4hBHKOhyQTz3uzJnHljy6YZd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
568	msedge.exe
568	msedge.exe
3392	msedge.exe
3392	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2684	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 4104	568	msedge.exe	84
PID 568 wrote to memory of 4104	568	msedge.exe	84
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 2580	568	msedge.exe	85
PID 568 wrote to memory of 660	568	msedge.exe	86
PID 568 wrote to memory of 660	568	msedge.exe	86
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87
PID 568 wrote to memory of 2552	568	msedge.exe	87

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3bbcb1b523bb75482d2c2a3c6976483d.png
1⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96e3d3cb8,0x7ff96e3d3cc8,0x7ff96e3d3cd8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11013665363888212219,383225702473277969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e70ae78-4b6b-4ae9-8538-59942ff21c72.tmp

Filesize
3KB

MD5
a3f89eac062d93650834d0d6b150d6cc

SHA1
7e5e88e92a0df987969662818f8ab76246e78a15

SHA256
bf9ac0c6139b0e39325320398c2b317e8a207e0d527df9c2980dad142428be84

SHA512
dd90cf2d1be68ef7afa4810214b69ede02d8be425b0cb497beaab92d992477b955b9bee8b963f89dc03c3144c4c4c93e68211096916f67fb5115746d72180d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67530d57-876d-48bc-93ac-1bf4101dfa38.tmp

Filesize
3KB

MD5
68a7a0f57c4e8287d9197b70b1f1141c

SHA1
02956441370157cb1776a01412f62fd1253781cb

SHA256
631f89f85f8fc2ad5040180f1315f3b48fc28ee102d4248ddf883f7d727ced39

SHA512
b0b520d4323c7216ff34a4d000f0e5a4ec017cedfa79cef9f248af08976cfcf157504ff77d11caf77043ed9afeaa2620d4f46a86bcb3dd10ed98612afe1ba5d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7bd2b2e8-dd02-4e47-a0af-60eb95043643.tmp

Filesize
3KB

MD5
6a343d5237b5be21db9d132ed8edfdfb

SHA1
6aad0438d5cc47e554ae27828aab7a71cceb7aca

SHA256
f2c29904cf2ab43397d10d14882e94ca499af75476f2d0860586d0b6e3ea8471

SHA512
03c844639e6c1f1ad370a89c28f6383a7db171b195b03dc90ec452882d86debfbf039677f3de7d40cdd80544b24422d8c9f5a1dd913bfdb9868e721da27768bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
75KB

MD5
63e02f0489e1e530bc08639b883073c9

SHA1
7752f6998d27e267ec50e0afeb4eeedace16049c

SHA256
042c865c11ffaddd017ece1ca03178a3c321516b4402d29621c061a673f328e3

SHA512
ec332d63ce450fea2f3ac5fe4dc368499f31a7f9a89768acbb99327b4cb9848742655e05d28091d994beb9917cc5616ca46f731ea09c9f3732c60ba0930a9205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
51KB

MD5
5137c9b20643c9d076e3cbcc9d0e8652

SHA1
e7e0f58883b4cba2424dcbb4dee8dfb7c8f8a79b

SHA256
8c92404433b31f76d8617eac595006e2598bae036a8e0713b7c66aa860903ef5

SHA512
47820435b936e1701078071d799e1c30909614f5aa1fad57d162d9315d54b8233297fc2590bf850fe65ec3b87dd54b9d62e46de36f34b1d8f31866a308289ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
20KB

MD5
b697f8604edc9875b0075ed06c69fc65

SHA1
933f120dc38868d832efe962f27144ee597275bd

SHA256
48c5bf89d95ed77f2ded5cff403c849aae18c11ee5512e9056c64bd2a57be797

SHA512
430a6fbeebc338435ebd764cebe62aeba5e08a53b59e3e01a886d2c4ef12bbb4e301a991f70794b8bb3f5797e56c9c6abc0a07baed12bba6070754e8aba66a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
62KB

MD5
f79882e12fe87d482fe216d30ef3c93a

SHA1
e3031f2d694529705d8634b397815cd907fec24d

SHA256
c95d79ddd197080d143fdbaf458ce6d653621088f2d16827b3037f4417a32f61

SHA512
075f20268aa1b46fd322da5220b1705e42076d6ee681417bc95d5e900c6ed9929eca102796757e5db387db56ed2e97937e074b5af75840e55b018623c0a845c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
f8f0443685b850fd23d282a8d862f9fc

SHA1
2eb5b79505e10045dec0b8c94374e8551a21878b

SHA256
a99cefddebe99da5400429b62250ff6e2e1d85de9e4a40b122893889fb081f13

SHA512
3d49cf1412863cb2a748d2ea8ef8bf72e9376775d732bc2985ee2aaf7c62f4ee2a4c4ae4f0948a0177d353f447d2267de0354091bfa4407cfc23c51d9b5bfd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8a1dc2a5b679bc118e4aed2c7b50ae9b

SHA1
2f931e9c2427305084751a4068d59c2b5e91371f

SHA256
84a26417d3e330e9ece7eac8d3a0be3f6337141e117c5abafaa8272f6400b94a

SHA512
9fa287eb994f7dde8299673241afb742efd309fb6ff7bf7354bad9403dc6e1b484adcf8065f6cf02afe46223cf5c87ec1532511a35a2f92e142c411bf65ae954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9b4d11e7f5b668aba7552259d7b1d9d6

SHA1
65208400c2dd6a3d9c9d4a1ef0e168f6d3332e4c

SHA256
978f4c48f019496979fdeb32e3ec9c62f333b4873761098406fa7cabcb551a05

SHA512
ccbb314ea8b8f5ffecf4ce16abc915f7806fbe3ce31ae85a9a3252c565b3e90211f2d8369cf982ab9977f9127099a2877d3b7333b5ec6bbcb1f86b4f8127d406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
da0589f8628e8a6a27956685f7a2e228

SHA1
125b7bb6e3672ebc9873984ba7fd2b1a2c83be1e

SHA256
8eac044f230be54073c4c73a6763616dad78a83105a74124089c5b101c92f561

SHA512
8910e86031294dd4c502d0152893ace029f815f5a06a6acd96061bfd6ab1f0f4d970471ed1284e4d099cd192db498605fa6b4fc9d629638ec4b376fc7f3f35b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
526c838e0a479b04e1c874eb5af116f1

SHA1
6ef6531d88f27372a5f9a58393703fd8bbaf6161

SHA256
7d9356e927a8ab095d2ecbf06f5d2fcd20ee81e72da19459326c0564452bdd79

SHA512
57a472c0959fe2c1ff2ca62190d0395d8c2543949a003bf58863071b12a20443dd4108c5f751a610b1f9c1dea94814eab6a095b30dd9ccec1a2e4794d7ce7cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
505c9f3afbf6f82818b631f4a1784d26

SHA1
e60c6e668c026c0cd2aba54c6bba35c87ceb76a0

SHA256
5128d51c133c8ac38e2b8ce875aec53eae66de9c1d8cb33ad954c1468db39146

SHA512
0ef058d7f5a50a0cf0c28433c6b0892b5ffd8dd19c00bd67ea3b204bb42ab7c975edd4c74829a31f3f9540ba805dfa61e199991e8bec9a6fc719708b7f0f74e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
85ce8e27d790db8b3379e953f37fc00e

SHA1
4ed068548cce5785e286a4a916d0e77a1b2fb7d3

SHA256
1f2f60fad2297231d8c329b7df2e9334b7bbe8a8fc1749619e20c7f59c86d749

SHA512
16236acd29fd79a9726ebf84f7e6c682655b2f7add5f48cca01400164c4f634eb5ffeaafefb3e6b51c5a674bbed46615b9da28879514ecbc418791ff9040023c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
498b8117cbf0d71660d5c7444e97bc99

SHA1
5e363a87aba9a1a085813c246123c8139d68b875

SHA256
a723a864da31833e202f5e28f23ba47070b379940f74054da24735cdcf4e3c14

SHA512
364faac66e117251b640ae74670e661da68b48be6883c5ec9fdf7b9e8c6b2f21eddf9fd1a5fdfe24991cff938bb7eaa66eb363ec4ae71203cf3b64f758b16404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
cf20f1db61b3652ce30955f6ed853e41

SHA1
bf18615e5e309682e60df40c0a3ead079e016bb9

SHA256
a7a65441c3b930e0e8c2cba4903c906fc606f2596b1847d01d8894f5d026381d

SHA512
c2564069cb6350797b29e80083a68cbd7a13d755f77cd110b6ed837b5d3646d1b37ac5697524ed7647a5c7a80c3db2c1dd9332e4ea48f08e0145c4f903be67c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9a42a11c34670008aeb4894ad5553ff

SHA1
eb8b9d246d8fba88fa59f15aa2aedfb636b5fb07

SHA256
ca3c2a06ea4c32ca8396da4274699481606d39ee1c81b270830c7120281079ea

SHA512
157af068193ea8235f517e8546fe7c01fa835ac33bb306c78248ed1dd9c665b6d76b47c473cfa5e725757d21962fc7633d43ca75ff52faafb4a043bbbf2fa10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0c14d9480d2d71a63de7cdf61dfa9af0

SHA1
eab1f3fc4854252e58e34df48b7427d95be5d007

SHA256
8d6bcff2a3af0be73588eda6a17273b7587f557978a035badef286477ed6f1f2

SHA512
04d41088ad68b313dc0d46ef21680b4a717951316ab91790e0b678cadb67aada67d0a4fa75803e520b3ba607ee492e97cff1a31f7dc40c9f3f8663b52580897d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
89acc234da9d7e4c2adfb92ec25a17b1

SHA1
d3162d9aafae7e6591a2076bb4b9e175613f370a

SHA256
2d22c159413fd498b4b37019175665701b7f83b5238b12cc2eb943bb08928be6

SHA512
5f31756b56dfb2ac0a5da68fe5ccc3e83493a07dcbda2894a51eb734fcae611ef0fa0c407fd6eb6d35038a9bc87d74828009ac7900778e95b6cbb8397ac09ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
191727c153dafb4abecd6d29005cd69d

SHA1
4bef8a6842e3b61d95929198042ee4bf9ebfaea3

SHA256
3dcc47f74c708a0822bb6356b82b2bcbad89aed2261b10180aacf3114b3be1c9

SHA512
2352b0d3bbcf98c7287766b56337ea36b7918e9d9840cbc1e865e776c4d91a29cdd061726aa9f07b3420a1707f4dd75d85623dd7e2bf431b5869f1f74afdd402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c2fdc12d8e2785016785af9345ae7667

SHA1
dcdbe1e0472fdbbbe65c58eb8b582318266c2a7f

SHA256
091961a67f9a18bf15b54595a5038b9edbe942d0bdecbbbbc122d436bea1e4ec

SHA512
bc48441d8dada4ea5644ebf383969f95bc575d6d02317359b98892cdc22382b57a47f200573a6cdc256cd23206b2de9c9d37b5b3be66569643877b8380ab848f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587867.TMP

Filesize
48B

MD5
6f485447e985822d74a4dfd95e30acaf

SHA1
ace566c8b25a1714180e26f38b078131f89b2f7e

SHA256
47d6c84bb81740dff347e22ed71805572c6513a8c1e6f1795918050330c43c9f

SHA512
9fc3b1ed3a36de44cc7a3fb268c666e90b72931e75431997d57e80f0990325e78deed3d754615d4e2310e54594a2a9f6383c0ad132916f5af5a5eaedb643e63a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
26f6881d099205c19d855b3d2348dfc3

SHA1
b6f0303b024a9f98f8b0e11ebbf538435ee76483

SHA256
cf04ef720b23504b4677af8ca092535cb348c9fb02fbecfc9b10b6b962f81ffd

SHA512
d6c96fc97ee8d21540b3220b02afac1e2b1c80060f8c995e93d47d380186806441dd5fa2ceeeee6325e29dd072f0b782dde1c1b824088bc702ead0f159b3637c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cfc9c0da70d73762494675929e10fcc8

SHA1
0a07f03384ebda9245b62272d384fedb625b3f7f

SHA256
89ee9b42b44ed5f138f523377fc59fb8339357bf6a86651e55683bda0c16ffd2

SHA512
f72af76e78e52c195f357b0bfb3eefd851a3e3e05d90919a3ea8e8ccd6b34c56ec308ba60641dc161b41c30490724260449fb1d0bebadf2eaa88e3155720a19c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48aff6fba170f1dfca16fd3b26beec67

SHA1
bd37a2f59bf4cc7467670127b3d35231af895b16

SHA256
54a60510dc92e7fb71014f0d3b157c1289138bddbb1788bed3398743869ccd9a

SHA512
121f17dcaa06e85c05f4a91b07fa59791491309e636d8caafb77aeee6ebed06d49fd3f8479af1b3b44f3343e04eb3a141f48bc9905c76687711607bacd7a489f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cb4fd8622e0a3253964577582865ed5f

SHA1
92492838994199d386a1e980abd94025f2083448

SHA256
ad3289a430ffe56b5a53383b35497d1f6cbdd3b14b6c710dbff7b512b1110de6

SHA512
46d055fd1fde1654737588794e177d0c8ffef356526b22935ed815434d2abcd5910498be5c5629657bfe14d5e9b36bd1efc971976ea301bb688c639666393a50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3745982aeb4e697dbfd35a1703da6c1f

SHA1
555918d9d34b3c21227cb4e6668b7636d6683b12

SHA256
da7d4c8bf4a70cf6e29a5b7f1378b87053879fb61c297f23fc24e1ef4add07b3

SHA512
4849f1fcf9ebf816c4b95282dca6145e815d132b43d77a92937a232427c19059b7c66cec05f3ae20906560dc8d08c8155342704d01ec4c38cf55af2745a281db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
345945835d844dd861ee0aaa83b413a0

SHA1
9c6f19be0611b625c7275555bb7ec20033dcf9fc

SHA256
dcbf14a3080aedc6d73a3f0555a16550fd78d8490230cffe285c4a238daec228

SHA512
7b09be439c47286939dfbe8a6eca0499f39151142091e62084dc384f315ebad899a68e051a497648cd4710bf7c77fb53cb4be4fb29cc1a41daa2f536b4b5e92d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
76893812c02273261f4433e3eab6bf18

SHA1
c4771e9bb8194134805fd3e52bce10e2027fa0db

SHA256
bdd7427408a91969f41c0dd85dc9b064a19205fad0c327fb5df7701501217e43

SHA512
4f786ce998f4dfde37f36f27ea1e1e3d300c9c02fe5c6dbbe8fc3ea33691b6ec40950e4d08d2ecbfe6956e699bad1370a5fbfa5e96d54cd9f6174ab68655c65b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
809418d0e43fc28cab6b6811816acaaa

SHA1
b66598b02e6deeb11fae506a49aa8afb8f56b337

SHA256
1bfe8232fc56e2610b0e00e913633e08222b165ff5831ccb5cb30d9f9492bcf8

SHA512
9a6d3b0b5cd7f6d07353fb1b5d1f14b7e767709a4af7e1edc2b71bf4dc2d8a0afe9590ce0f98db10f22b088ba902a54163d4a6b8d943464e685190643d5eeec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6272c8c093e6068641cb35464a6035f1

SHA1
0edf03b7a46dce645b0ce7a01700cf5bb6b169f4

SHA256
84eb831b549a6c1e36c85dc7ce1798f12d1efcb1af01fc2b0fc87fccc03f8023

SHA512
ddf1b9bf4bdeeedecfe68d628376abe139cf14ecaa64b8757c4b287f68f7d4747be4dfa3df512b740159cc6cfee90fc8a383f2262bd18042ea3b1a7a354b5bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
27c9787b295e028fe5533d0de51ae8e3

SHA1
c3dcb4be6643296eb0ff7bccbd69176014d9219e

SHA256
a0a80490e690ff76509d28b02d62eae6cd2be2d687a6fa5c28cbb665b9078585

SHA512
11902a95b65f07f93f5c568e701ff524766e96421f51fb8b772dc983d2d96eb4f7dbf4e4dc69aacff8c41864fd2c32c433e287b059c3d334193465133860f71b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9b7864cd2e4327a5039405f86872f3f6

SHA1
3c344718e48fdd1d96b54d1b7c8408cc32deeb00

SHA256
7d486019dac4ced3032e6aa7797ffcaa518fffc99b1be2e85078d2ed087d8f33

SHA512
6cf8be8195ba6ccb5d40b57faa4c2d6270afba5ca3c3ffa78fac039441c65046674bc1ad682c3fe498f071cccd72fb4d3285f254976bcb3520fa45ba02951fb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5a4e77f864cf474477cd3752a62fb278

SHA1
f227e236059b33cf890cbe1afeded142570e7163

SHA256
162ef5cdea46b216ec6f40fa3504bb8feeb6c09092374629cd26260fe42554a1

SHA512
24efe33ea41c6fac7f9fa54d610b5a72e3872b34a57e708cde8e78d4bd531a06da8ea1bfaf4d9b8cd4dce222da1ce3ff6f88294122c97056a3fa7d45e5b90bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4d3c29ed5e23b5b7763d24a0470746e1

SHA1
27992b4d47813fde8810c64aaae1cf8286c556b8

SHA256
6ba166bc937ab7fe25d581f7da8b6b4febe3c5615c2790765eb3610288148934

SHA512
383d91dd3f5629b568e79e70ee23d5f4171825ed02d83588e8911556a155df846d4fb693fd9d8ec48419b96baa7b2e26bb996428313db92ea5a139d1d37b8204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
40851775c844e450ae9657821b1ba206

SHA1
2e57101c197cf7dbe56096dd73232ad90e8472df

SHA256
14e60c8a9ebd0e20924dfc74cbc814570ee58988779f5edbcde914d45034622e

SHA512
edd94a5175bb65f8d7b922858dd9b6bdb02e84d5f69907391409cfad36c775687dbbb5e1cf6929f1f7d2e6dc65bb25065edc63e2fc88ff74d07d82c32e829b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ea44b27477bbed84d3788188bbeb008c

SHA1
213875eb171ab9a03d062e041b18aa8dd0a8d1fd

SHA256
580f165487bb309b610dd61508ee4d5c3a6b1ebea2e3fb27559bf0c868d362ce

SHA512
6852c79df7027e89c4052a313de6c22c7a873bdb25020f04fe538fcc4d796b7930f8bab7b6a114b53a948d90fd145719933b7591ea0c4f815a0e8cfc8e88732a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8322ab749d2b0f8d6164d67e15981089

SHA1
3f8ec25532744add09bf45eaf30a0b797b0281af

SHA256
a8fd81daf2b853e5f8807c9555e067b23dc04143f09e9c9641024b9460d0d31f

SHA512
97716d852f757ae7f91f54e23ba7230bb73ce17ba75055870f2b047f3413e0c28ae7754487b89051b6e9ddd425f78961dc1b00371c9a9e4be66cc84f34497129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bf76f5286b545e37d5bed663e515da6e

SHA1
0e61500f8768b3528fa8dfa359e1cc58cfe788d2

SHA256
a2d9495e8ddbcb8591c343bbbc3b09ac37457535c0e3caf3c390c29c807765ee

SHA512
f2783cfdcb069f1b3e4ee6d9ace2e5b9c268ffd8a4b1e71bce259fde4a7a0d2b616a2301638406805a13d84e3baf38387e12f5def4d5bb2a9f0384bd2b2dc320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
33289b10ff05bfd1170405a53442c3b9

SHA1
cf109c7dc75cd0009f6c4da4d1d067fcb53eb9fc

SHA256
6ed706be806508e41eec62ab017e8c8f86cbfc6111e9bb728217f2a956cebde2

SHA512
907bc173722f46884a5a3804635afc5ecad97cdd3641fe0076f86f327a74b7d34b1e1e71836495ab4a3ba5865925d9351ba13e474af9d24c0a7653bb68a9b652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3429232b5b3e2d00ed8772aafecf61a6

SHA1
f5c728c75a8b487c52ad8d57c124062e5d814ce6

SHA256
4066501044aee1248c97bc8f80cfbd0a374729524a6219532674b4dc1243a9f1

SHA512
50285a491ba5cbb32b18664f7cf6905adcef7bfc93210361bf777009194d280ecad55b32336c911b0e4fda513330309df69ca4a6173a21cf122953f225a633ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
450501ca22745590ca4aa8396bfbd671

SHA1
d30284e6ed0a3693d1c16ef9655604d53de6a431

SHA256
33f65f87aca255a0e3198aeb33094b129b5ca6391c01f880c5c190c38183b3d2

SHA512
42fe2284c0c797152004a3543f1181042a83da52b94893218a746bd132ae04157f7ee4ba86c3dbe8c73a1f99f0d5be1b569bad83ae7c4bdf329c90d1fd36c7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ec32787dc946e2ef333c18c9ab5ecae3

SHA1
6207c772fbc7d82111dcc5310b0b5f61b4eee91f

SHA256
054131001dd0e404f0144a09ca92a1892a7d4e3ad0e61ac4aad65a38a8ec8b61

SHA512
51a2a0196e5dfa0d69fa96c771fe90a80bf688a877f256a52b15db3080a0157fc2ec93e965e8217cd1181ccdd85ff5bd020a215919128f154015e9e2cddf3246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1f3f6c702b6c5f1495ae064cf3f7de6e

SHA1
ab2fd4e02a7c99007d131ee3cfe1652180dee4b5

SHA256
85b9c5287c253995ef4169b46472f2c82452d01b3b186995c3faabb2307b8904

SHA512
06d3dec7ceddf3ad24753020eed13fca5f0ada4aaee9ed1e02c79a4449fa771c500912080b5b6c161c43fce964562a46e67a0d0a74886516e577db2414cec4d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a36f24df6937e2a00131ff2db56d7245

SHA1
57dc10abd1de0c16c8b09efc335ffbab3c8a93f4

SHA256
f14310aa63d34c93afb51bc0ec44dc3d5b154d817d07e7159987e4479002d758

SHA512
b092f35f84e4af72a54568ce8a23688fec5f51c7304be19fe77f94ab9d503624a2edb3c41c29a7d4fdbb54b2584e79a3c0fd47ff4d2cdb0fa29008a19d9dba5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7542f92366f4a8d423637119eb91ad34

SHA1
992ad53a47d37349218c4fd1f3e8e8f48595a5fe

SHA256
a3bd2d4599535c679301e4054784caa230e13bb006623823f6ddb6286909e326

SHA512
275981835e0979282b8cc3ba55552147e4d789f46dfc763817ec8765fab6925003748cc75768d2daca6024135c6f01c8fe5e3bbddafdb45b77d37eb1c7d87e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3a18454a5047bcb8a3939c0c75b4e625

SHA1
e70ca199fb1f35e636246b9eb5929629df6b0148

SHA256
baf31d98caca0bdb965f3f6b40c2287330841c788d70acf44a23b8f8d1a4c132

SHA512
466008fb82b3e929ebd8a31096af92d6e2c096393e6270288d286e9f5a75ab596896690755beacccaa6e0ff050283d0c3ad995a241b5c8f707647cb7d50d3fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9e0d58a14edc831c1675b2228726fe05

SHA1
e8062bbcb4773099ede2a8f1938a55f8a50b0fad

SHA256
0d1a026fbb14fa68edfc86033e54b56da5294a87195eaf221eb8c2c41e701459

SHA512
b4e20d19958285bb866d4e7af03b192b91b1e3b4f2a29dc5eee5269e7654f24eda8e5d1df8c02e689738fcb178f899090cfa23078e950a2e596e9958c47d7ab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
06f8fcb958e06cf4284ae04abab472e5

SHA1
3067c8ba0faf8c69fddad8c0f79cffacd7f8fd4d

SHA256
43a38ea2522f3babb65a0728d32fb7d60bbf1d912a45857f7d8f9bdf641eaecd

SHA512
9e430308326e3ba0618a56a805723f46af411b4419cb7a81d165fa5b5091aa28b786c7b5ece0867b138a3c0674cda6e8063299635f5b04965a0791be80189971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
06f4313fd376a13ecccec09e4254cddb

SHA1
5b798243e280e4eaeb440175df63e871c4ebebb7

SHA256
8150bbc7c2ca2529be7e05c4b66abc73b115cd6ce70da95d96a27712fe4ec4de

SHA512
5e4e6146ade52041131fb3880092b4c234cebde4992c309fe05deb2b5d71b2f863c2154e4699f32b1a697be41cc4ba7f1a37f4202296e6fd2b6bf5b6126c17d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
975bb90834b88fab8a07761ff48abcc0

SHA1
dd0258ed0d115d8808eb79c668384a6b81f48b79

SHA256
de9881cf8a1c1431b74be9f97c5ac1beb114954348d05d94c510c4777c66d185

SHA512
a7a7dd0f13753627feced2bb94396a4672648deebbee0d3b4f7c04ed04dcdb997f5a7b05e9b1a3a8b5fc76a1e64ff6c052a8b12c492d6d77f2bb748e61ecde9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
846df835bc1961ebf34ea210a59d0acd

SHA1
6dd0096b1ca01ca218d90c41495783bd62ea5baf

SHA256
3e5a2805db9ef2ef8f5f48736ee67162d348b86b7be64c6de52469406afc43d2

SHA512
763ae521245b4cd4d1266ad532865befcfbd49af775bbae8980b0aa6963b83f69bdce4c9ada29bb32b2cf9d2287a010d989ca67b8ca4c944aa77ae4bf93278d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3b67b3bd8a14d554811e5952ffff95b2

SHA1
94171e4ea900e34324eb53a93a7cbb31433bb91f

SHA256
15ff1c0ed1f32a0a8b520661cb451f4880e040dcda2d39c59f8c792452827194

SHA512
19e1813360176cd069a5fd1c56bc236a26cee2348dcf6d360ec08a538c8bdeac1407c848629decd033529485ae43e3c31e34d63a9d182c8713c03d2e67801aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
aba14a53bcb0aa69d87d2bad407cfae9

SHA1
d1b45e91fcf39ebd83d3bbc50837df0c7535ab5c

SHA256
62a6763c93ae9bf49cf1e942656c25037f5a6c5850651059047ae34dbe0db65f

SHA512
49370f422588dc873960d533eeefa53ffd348553cfe49653f589bb11ad6b111be199cd63f237d651d02b69a82db410a05174e80a394af77b5752ec99a3e86cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
af2b3ecbeea95307bad6e8b232c3f836

SHA1
eebaf3fdc437b501dbbb8c8d3bad901d71d39843

SHA256
51b655ea840396c4c4a02e2c1a4611f2e0395c665ba594491920c2af48b76446

SHA512
c897d326f3f34029de0920aef437fca4776c89dba128fca85e342e6a22cfdc93f8b8bcbe8648f2da5cbe3f31f9834955350a07f661e9fc4607bcef7d01a03494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9a09c5cf0206294f82d35434f8f38280

SHA1
64c233051df47466de3ceb18eda5c34636621636

SHA256
1951796643e0862a0d027834c977ebcd3a5c40f2c1f3bd854aa24a794d879cd2

SHA512
7e18c334da4e98ac67b6ae3749f911f70a5370503260939e0a2061988e09a4b37ad734e0bb8e396cb351b48c0d0f0393d09688363b48169efe7f1ac8b5a9749b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9ca43e03b087dc36667000e380658971

SHA1
f9c1761155d5917543c2dd9fae5fc0148187c14d

SHA256
0c91f1ddb66a43be555844b609dfb1bfd3cf725ee7cf89f8dff99584060f2c6d

SHA512
1292c8a7734d78479ebdfbcbf985090fe5afd3fcc28b2e51ca0474a5f6d3dbc799e74b8a3741e544f1d179d4eb9a3679d2318435f595fb474e720f3f32be43bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b6069927269ef0d58a9b6566504d3f32

SHA1
e95497d5a719f2324bee37e58ccae84a99e131f2

SHA256
043598405d917d5f2ba0060272cada58745b72cae9159535c474049fc9463f1e

SHA512
0df6fe8bfb5947d8644f3dc9a22775bf69730359cb48faec52bfce989c0a0e2b57df876dbfcb35316afc496107fe4fbe6b4c45ddbd7d0795737c54816d887cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a8608ec30fc11252502180a41a306706

SHA1
e86988f1ea20b89663055ecf2cb846bb12761a9a

SHA256
1d63385e11cccd3b63bcdadaa01b2e2aec70ab04aefc76d5eedd0d24c42a20de

SHA512
1e31d2d5e9940cd066c514eec62508e4066009e8e08c5861ff04be616f0be2d374ca7cd12d45d6d20bd8b13662b80369b63767ce62505c6adc96265843266fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0daddfb75aef804790426eeaadb88325

SHA1
b3e5ee993e2f30a410db7716dfe8abbc02c16310

SHA256
a3c0c5b442c2369b3f17fc5e60218817c5be236a36d5a753d86aa09e5f743a37

SHA512
4e2a6855a12baf860e89b4d78c19416fb947f64c62d60077392de0a0528cdd209ee592225190690adaf595c0408ecc45c6e79451ed18182258fbc85e0c2b156a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
32a52fc4f0cbd93aadd85237649a5202

SHA1
0aeddc23eccfebdee3611639bbe657fb982bceb0

SHA256
078bc8b919c915545d1fbf908db934d8f47d5d176b74cb2915f3145852d37f5f

SHA512
d8cedacb3372445ab7a20aec1a4b731745b77e27e9306285e361279daa9ebaa37b0e054fd426330843cd02dfbfd655abc44b2612861f62e403c3c1fcee1bd408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0b0f5d1911cb0f6a2effee34199ff79a

SHA1
c7e7b2a53438393dad5f911ffbeea3ba18fcf75d

SHA256
a88f55bb7d472c0987811286c578515336791f89f0ab9d65d14990b584c41c80

SHA512
49426fa4636ceb1a85dcc51705bac1f3a8ca545c216e8736b04e2e38107c4161ad8b6e8e2389ddc0cc8a56d01f5acfdc44d6c45ef8b1721d75c8260c4b69cd56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
df691bd0f6d584af989f9eb4c706234b

SHA1
5c962f881d4da38fc50ca2fd2e28a5d998946a37

SHA256
775d2fa905e579e17ecc927454d98c28ac7162d21261d5c6d026c2d103beee80

SHA512
d9bc664d692f0ee35829444a930f08a1995b1ae253b1ee23ab9c77f85da2815dd879cd52f97b11fcbc0fe45e24d3d4c7494270c48c2c1bf491ed241203458c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
293368b65f8442150d54ba67c5abab72

SHA1
7bd7134104cfa826f4fc2434701e2279ba5a7f8d

SHA256
cacb97221166a084fc3a37cef638418f6dbe24a84acaebcdef984e73ddbe220e

SHA512
e94e4f1dec84c22949ec48e2d4d062562122275b4fa83d62ca5942b1d06587e4cb97dae36105788f0c9b5c65b035640d4622d8a5166f23577ce68837f3397bc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c5cc2130e8f27129316f80d225f53cf7

SHA1
361d024fca0693489fdf2a5e64207ba3eb561d6f

SHA256
8dd0771128b6fec79dcbbe0cb7594a721f8c967da1229ebbd414b645a632d3ba

SHA512
692dca04e7258c4b6b6b6ad832077e4db65709ecfd48381d633b3947ff4a6d39ac47a997c523d2f9f040ffa9365d9cf754c7d9888c238cffaa28e1a6df1fa3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bc6dbc13bba936310eded6cf6d49b64c

SHA1
7ede90b50888becda7c635b16ef60397ba330c5f

SHA256
5ba78226771768cb35ca86e593f4c4718f26258e49c9ba99dedc899c96ce5d37

SHA512
914f3c023d1ed871ddc8079ea30c604ac36c6df485e51473b6bb020422afd02f3a382990ebbd15116f128f7806b6f47d9e76e3b189347357fbd63c2c1cdf238c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585251.TMP

Filesize
1KB

MD5
2cf9ba665179d075a5fdd82eaa090a56

SHA1
78965f6eca4707acf6675a103cb5091ffcd38324

SHA256
2f034604fcd7cab916e79aaaf4bc4fc4c8442fe1b782015facaf8f73872e12f3

SHA512
23c9dc2993ac594b6ee2cebec53c9114e8dedaea384cc905ec603c4ee8789549f7cc3ebb4d661675c4c3a99afff83fe51420feb14c6fbfe803ef6dd0f1fedaf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d52d78071c9c2f841645726ce96b7236

SHA1
6423b50f8ec5b82b27b976b00e16ef20bcde4872

SHA256
eea65f20061f7a49b7e84d46dac0d2f2039c63c3086b6a8047a477a2d58e68c9

SHA512
888700dca0bb9dc06fb3cebd564bc021b3a436846f78882e502be2e1b7ac8f702f4fa3859132fc93a36ca0163f0538fb8598191f8aa59c1382dafd46685339e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit