hxxps://gofile[.]io/d/4J2C0e

Resubmissions

07-09-2024 08:54

240907-kt25hswbqh 1

07-09-2024 08:45

240907-knyvxavhph 10

07-09-2024 08:39

240907-kkp4lavgld 8

07-09-2024 08:34

240907-kglxrsveqb 8

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/4J2C0e

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
396	winrar-x64-701.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{40953B15-E997-4C80-BE76-67201845F0F3}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 565582.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
3448	msedge.exe
3448	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
4344	msedge.exe
4344	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
396	winrar-x64-701.exe
396	winrar-x64-701.exe
396	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 232	3448	msedge.exe	83
PID 3448 wrote to memory of 232	3448	msedge.exe	83
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 4764	3448	msedge.exe	84
PID 3448 wrote to memory of 1828	3448	msedge.exe	85
PID 3448 wrote to memory of 1828	3448	msedge.exe	85
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86
PID 3448 wrote to memory of 824	3448	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/4J2C0e
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcad46f8,0x7ff8bcad4708,0x7ff8bcad4718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9226388722232063130,4175353541248030095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59457945-a720-44f1-8c8a-e17eb903e5e2.tmp

Filesize
6KB

MD5
eadf826bc39df91458ace6e32cb98ebf

SHA1
91546f313380878f70272dad934dd3d6618ea3e4

SHA256
94ba0838ffb5e01270e8156c59e3ff7f99ac6002958b885638293162e9d330f1

SHA512
a881c077a3f51001b98a117b619d16a7ee5297849feca0190daf40e60d1201009c0e28046180f3df886fea11dc43aeacc7af145a6392da1aedcb7c247ce173f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
41KB

MD5
9101760b0ce60082c6a23685b9752676

SHA1
0aa9ef19527562f1f7de1a8918559b6e83208245

SHA256
71e4b25e3f86e9e98d4e5ce316842dbf00f7950aad67050b85934b6b5fdfcca5

SHA512
cfa1dc3af7636d49401102181c910536e7e381975592db25ab8b3232bc2f98a4e530bb7457d05cbff449682072ed74a8b65c196d31acb59b9904031025da4af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
1.2MB

MD5
ec243fbcccb5b0e668f5fb61022703d6

SHA1
bba3c73a78ada8d539a5010efc93b044f9fb91c6

SHA256
86c140bc6e59e4c6505bb2b6743ad0917156b63f68a4979f93810bd04d850bcf

SHA512
6fd45860bec622aff7b7d84788fb2647a9eed4ede28dc8f8b1eef1d9240040eb88dc2098d239ba746c184139f21783e5d54570a4b31a55903aa785a5e56ed334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
73KB

MD5
cf604c923aae437f0acb62820b25d0fd

SHA1
84db753fe8494a397246ccd18b3bb47a6830bc98

SHA256
e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4

SHA512
754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
25KB

MD5
662a8eacbe2122448dac469755a70e37

SHA1
d921fb71699a405b09da754a733f672a54ab8bf2

SHA256
c8a9584f6a79694cf3f94984f89fc9c86ccbac676a563b821912b95b0ca578f8

SHA512
e53f54be9806e3b960e1697275b32c43679492fed694fcb6845f8bc301f5fc135e67473ebc2f6f49e7dd7509ec14a6485ddc6f538f8c76e7aaecafffcbb8776a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
1.2MB

MD5
ec917682b53eb90f308a85d16ea7728b

SHA1
f93f34a690515e91608fdb1e21a7c40d8445970e

SHA256
719faf5ebda0ad790dc2385171dac752aa6ffc4314da467892dc407278985f65

SHA512
3a49a407924704663684ee09fd0cc17c06fdc5dfa531e29bbc08c24d25b541a57ac4548c60df27ac66582951e246a670ac096c06e45f73b295c3d00907ab491b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
89cb930af99b2cd4d81ca30134034ace

SHA1
a9b24760930f7cfebf84a4813bbdda57d4e230ac

SHA256
e3baef46d52feef457a8f8dab9a54729171a85cce6fedcae572f98b4ffa06f32

SHA512
efe1b9ec04d06e7a6905323cd79ba3faec31f7eac08704ca196aced2fecf4769dad211d458c7773209feccf2aab5f148adf7f0c71d3e1d369bfb03ccd4a03feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
9206e891efcd3a241cc0a1d46ee4b91e

SHA1
784a3883902947aabf39de98f7522a32c584abc0

SHA256
d2c0bd36b9f1fc9971dc90ffb5e16a15149606327c456dd584991a4fa26ed1ff

SHA512
a02c04db9542d83961edcae6b5c2dce0e5478703a9152559e10fb5876dfa132ae2502f73d139425383c14cbaf8caf717c8b5413a25eb0f3fbb345d75427d089d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
1f8ebe58a1fcebb3c602d9cc58e52438

SHA1
b883db3cf3b61e6ccd1607476b761a9aa159d10f

SHA256
e049a4b9e44505aeb936fa49d1776e05376080e90c17d893e21c107f20b7deb5

SHA512
8ca07e703cb7fef4589bdcec16c04592f181da3c0edc775817e8de9e49a59a7c533afd9cea392df2d8b43e9d3a39fef30884b23847284f086692839a66007b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cdd99e9b029045decb0b27ea0c4e78a1

SHA1
4fc2f53547b8fa66185ac4a3dd6bc87f0d497f2b

SHA256
9b702ae44a21207eb67706aa4fccaa5a41803e5f6e1f60065ceee625a76606cb

SHA512
f091e56229f3daead54a1707d646246508f57360f1e3859c0040e1fb1e6138a666fc4a0681734703b138e604f3bd55682f7bbf64553f69443779e572bedf7566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
461B

MD5
f7de959f144a95b6e7261ccc12e3bbb9

SHA1
8658d189c7f92ba77336272ca7b7d65c27cd5805

SHA256
535e382d2bcc2b04d3a31dc6f6e3c1bf0fd29f1df90ccc6fe561ccb0996c069f

SHA512
b4f121b91593172300a8df12d11748b163c79e16cda5b7e82f51186202acd96461aab0f5575b50e465b443d53cb98a8fbca0a984de050111b5c9e73a9e417e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
533B

MD5
0bd5385d12f12bc87b4a5f631683df90

SHA1
9ed498a15ce782222bd7b114a1e15cce568cb69c

SHA256
7e4372b8d440a1bf4405c16c9f86d8d8fd6fd5e64196e263b6935056f1b21215

SHA512
be38d127142e93b0b2e34ee181074a99f363842585ce420d12193e2268f0ea80407ccd4d68ac92e00666809f0e16a2966c5534d5bab76b08e857714757fb267d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
960772c1dab9c496dbd902f696210bd7

SHA1
e6ad80e9ca509ae7482414a817606147aac4fe21

SHA256
ec403012d3494b3212e01fd8870e33c092daf4c9a32079014501dd81ca493220

SHA512
3004a9c76fb143625a543d5c8c5d49e9c9a834bcc3b11e2b27fd03f08b66e34fc937ff2cd3675c4cd3ccbe2f4d33ab38bc2c88a70811a84331a0a4ffb6ea6c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6847ddadb1b55167bac44c859bfe536a

SHA1
0339363bc1d5191d37e7987079c231d457e28a38

SHA256
85dad67c6ca114fc51d3a4909001cedef30d847ab2f5ef9285a809f6a3b3d446

SHA512
6a909d836fff618e1bfe52eabe97c78490887b8ebfc80201fca06cceb6e81b875f1dd82210b483b1c22c15919ac6e0919f2c24fa10b2bb2a284bff565de26c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
44ad56387a0f2c751f4957fef0a29609

SHA1
7a55a2cb58c8c001d25618f7f8b16bcc804268eb

SHA256
ba3cc2f7ed941713d4f6f4f6f5ae59f81f48ba856166216175ba3405ab205162

SHA512
8e08929ef862747c0e5054a4f3d4b359d28234c224c9dc6809046a2ce1f9c7cb5bd315ac655030a356245001e01619765fc1ad12efb9265dd50636ff97158085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a865088824243682e4cd955a3a7860d9

SHA1
440a71c4a8469157dc42d46ed1984983b2cede84

SHA256
826b99797728de66d0e38f0a618c5937bbb0b6fe10fa9c2d94255318f4081f5f

SHA512
8ad762f0fab3b6d76c8c9496a29e10dd66ce6d5b9bf20d37d024c5117fbe02032efd97f2d7b01fdc90f27eebd0304c123c0999298642b2214b6041e9d010e2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bcc2ef6cfe2b8ac075913a402c3e0c9

SHA1
ca192220f04ef7f0f1f5f76398125af09ca0f4a2

SHA256
4c950de3c44e39fcecc01b70bfa89d56126fba922f406ea5a8bbfa5fb960616c

SHA512
3ebd911c6a76dbac3503114752a77b46c1ae8434f53d21db3c6a49f58e90e24f2beafbdca79276be5cd3c69c3e073b3b241da01b169f985489584c2804235743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0a2ac5005bf9e80bca96c9f875aae683

SHA1
7a2ea717ce9d6784a4d51577800291dd9f3e3fad

SHA256
7c94aa2f3733ad7d1f266f9c95396c7e254b511ad80f6085179cc8781074d0fa

SHA512
7f9c09367e28e910bbad597b2312c04765d8147938cc6e59c22b561591d976b3289d2d059840603564ce4ec71939b09bf40c0dbf275c4232ec2247172cff2e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1729f8e0b55865801aa6b9a63b999bbc

SHA1
e66ed38fb547c5229ddcaa240d466e22e0de747f

SHA256
b9e1f7e83fbf78012c56420758c7cc94377343179c8f93539614e102b7e06760

SHA512
fb49f2653192be8356331c91ca0448d8ef3704cdecd365691e7200d8d36884c132701b773ae38c846b3cf8b1b9e9846128d5d34ae29564b598357f672455c9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ede62df3daed03f25c6e383a51ee72d2

SHA1
e44fc8cfd70f0cc142fe1f78eec4e7419c57a238

SHA256
1dfe92bac03fc3e9c0226d3a455755673e11245464345e7bd0636ba663524251

SHA512
d404663d7b3e230d85986e954d0542a64858c7142e6cfa2b3f7e3fac9fab6811dd7311fa3df3b668880ad5cd9f343a5afe99eaf6da5e26a3352151f723348b18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4473e9e0810e1c9e3a67ed60cbd26ad9

SHA1
6bb9cba1c10338a76689c738933d18b15e9193b1

SHA256
0ffa577f4dccc42b2fe0cbb3f4bd662e6f38c861071330ab3036665243eeee2c

SHA512
0260e186e3a1086a11225bd1933ab86a988b9e6ef3ca07e6675021c9e50dde40a437b57c7b4e4508a7ba439ba552994b96c6b37dfe833fffcca6bd92d879aded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
535B

MD5
3de2decb36210b6e23ea4071f401a624

SHA1
4924ab7b805d20ce78abbe322f3a478fb385f76d

SHA256
3556bd25f3ae24e787d53df807d2712d948bc6bc031c78865f425471b8d3b6dd

SHA512
7c9c8f310b538cba667a86fe4fd9b092c853e947b9bff8eebdef0d6b89d209d9f4a8d998bcf5242ecb88f4552077e79f5087a4f898246489647e5ed3960e043e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
47cc6ce87a2a9450feaf6f7258288119

SHA1
710d44172b29d77f2c4d282e82b9bfb44039e500

SHA256
50914d982d27b0b120f75c19c98e8c42beb353fa2e2dcd0e250808171fad7fbf

SHA512
54658e171ff7214aec76572dc814fd834fd2c88a2c94aed33ec9ebf143f1b25fcf4a8b4cf3bcfd76573c4088432d38c7367ce94965b50c98d7813212f093f01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0109f6fcf76c9e0e8891ef15a317b17a

SHA1
782dbcf5ac2dd9886d5ae7bf4d6cc6473f763a5b

SHA256
1ccd6a1095d1667eba4ce698866e8fed113448aebf7626cef529fa827665a9ed

SHA512
fab25e03103e1e9ba62713d984ca7b4fce6fb506724bda099b38eb8e917c29ab58f7cfc7dce956a1cea829461345805da71d01e069b75e35b77e9b65b6834901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c86a0935b45378a2cf8f88731024df74

SHA1
bc79802dfcdc8dc80253367d86ba829b111526d3

SHA256
372cc0072cb736cbb57ebb5a534843eedc9f3d905286b0bd582c42a08a902ec7

SHA512
1e0463385b35a7064abaa27bf4c128b3db0c842f7691680c79254346bf3f165fce2a134a643c86c2150384f7590cf0febd5f986d2f5f3e928fa42b72bedfb3f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b726.TMP

Filesize
370B

MD5
6bf3927cd707666f4c2d6087b5ce24ba

SHA1
c8109db846f9cb0b0e195a2cc76da45fcb0d41cc

SHA256
baf5895290e85074f86e2a34aa3800d742af2055e7ec37ea6047fef609ee8f37

SHA512
0d6d80b84356ad6a01bbdd91355b3fb90fd2b34b038fca798997859adb67af462419fca298a45a0248765421e75211022a2230d2976d5f6c7c834b67f3a5e93b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7080b158a78cba83138a74eb29825db4

SHA1
db844fb4c2a517bdb0555013efd8cde63d923cc4

SHA256
1aba28c2e682a993f04d39e900c2142fdfb1cbb3defd4e36f5a2db4b8396a43b

SHA512
4c39d5c126b97db92e946e55fb4a6fc391decaa0a718723511da9936cb7759b96f04ed5c163dea9fd05beb64f0e3e967cac15d3bfd793b4606a2d532919e640a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4fe06c03f1b0d9671514695934cb1332

SHA1
2801962f0c294345fd4d4733987786ca7f0a328d

SHA256
76290403567a8b4273d7dcfae19aa6ce009a85036883dd1023079f3463f4232b

SHA512
3428e0d379e16dabf2043b841d5d16bf7e6cd07df67650b009a0c542e947b419342863d5dc54ca12560186b82b02e5c4e9b82292227377c442fb19a198835df6

Download Submit
C:\Users\Admin\Downloads\Image+Logger.rar

Filesize
12.0MB

MD5
589b735f0c76d4b5d0bba07fb90a9c23

SHA1
ba0a25d41d5bdf2de4c3c56c2e05a7beb7b899e9

SHA256
93af64ccfe8c3e93bc28536724b1d1d2466d702b3841cd2cc83924846c39f7aa

SHA512
6a0718667a341c53ec5bbdc529e5710422a64a19282e2d50db40b86ac630f1028a9ecb990659d31c3f4de3c51bcd27bed9e1b0a17dbe24530a135efe7a436703

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit