Resubmissions

14-09-2024 14:15

240914-rk2wqaycle 10

08-09-2024 07:27

240908-jagh2atcpp 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2024 07:27

General

  • Target

    FPS+.exe

  • Size

    78KB

  • MD5

    b330768ecab3abad7aff662542e47b98

  • SHA1

    9182c254d638fdb07f64819f113af6e3ed34466d

  • SHA256

    6d1703bd786779f40dbb4cfd0de3e39ed7f09afcb8e3555aabc1bf6839ccb4da

  • SHA512

    b62c74545b125dcd6afb4a7923ef52b6b9ac798796e82e7d2229e6748a8728fecbbd197375ebf6e2941451d0ffeb3c1b1d2e33d6d86792b65cb0d1ab75c4949d

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+JPIC:5Zv5PDwbjNrmAE+5IC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI4MjIzOTgwNDU4NjU5NDMxOQ.GEkcj7.DZZa25XaQvgv-ZVRs-HJbbZyRm7z_fvhKTVxyU

  • server_id

    1282239514231701626

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FPS+.exe
    "C:\Users\Admin\AppData\Local\Temp\FPS+.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4928
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff3eca46f8,0x7fff3eca4708,0x7fff3eca4718
      2⤵
        PID:3912
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:1064
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
          2⤵
            PID:2836
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
            2⤵
              PID:4396
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
              2⤵
                PID:964
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                2⤵
                  PID:4116
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                  2⤵
                    PID:2220
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
                    2⤵
                      PID:3632
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:872
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
                      2⤵
                        PID:3500
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                        2⤵
                          PID:3608
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
                          2⤵
                            PID:624
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
                            2⤵
                              PID:992
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
                              2⤵
                                PID:404
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                                2⤵
                                  PID:3036
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5496 /prefetch:8
                                  2⤵
                                    PID:3904
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                                    2⤵
                                      PID:4576
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
                                      2⤵
                                        PID:228
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1
                                        2⤵
                                          PID:4896
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
                                          2⤵
                                            PID:5068
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
                                            2⤵
                                              PID:4748
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
                                              2⤵
                                                PID:4168
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
                                                2⤵
                                                  PID:2064
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                                  2⤵
                                                    PID:756
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
                                                    2⤵
                                                      PID:404
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
                                                      2⤵
                                                        PID:2688
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
                                                        2⤵
                                                          PID:3140
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
                                                          2⤵
                                                            PID:4484
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
                                                            2⤵
                                                              PID:896
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
                                                              2⤵
                                                                PID:5332
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7936 /prefetch:1
                                                                2⤵
                                                                  PID:5420
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8156 /prefetch:1
                                                                  2⤵
                                                                    PID:5496
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
                                                                    2⤵
                                                                      PID:5508
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
                                                                      2⤵
                                                                        PID:6008
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
                                                                        2⤵
                                                                          PID:3444
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
                                                                          2⤵
                                                                            PID:228
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8508 /prefetch:1
                                                                            2⤵
                                                                              PID:5864
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
                                                                              2⤵
                                                                                PID:5936
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
                                                                                2⤵
                                                                                  PID:2792
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
                                                                                  2⤵
                                                                                    PID:2072
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
                                                                                    2⤵
                                                                                      PID:1344
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
                                                                                      2⤵
                                                                                        PID:1704
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5284
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
                                                                                          2⤵
                                                                                            PID:3480
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5392
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4168
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5936
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:1560
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2344
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:5140
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5156
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:5168
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1620 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5176
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5184
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5488
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:5316
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7588 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:3976
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:5432
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5444
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8256 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:4912
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:5324
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:5348
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14915954961364251899,10193439028370239355,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6152 /prefetch:2
                                                                                                                                2⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:6024
                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:3152
                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:2916

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                  Filesize

                                                                                                                                  152B

                                                                                                                                  MD5

                                                                                                                                  f9664c896e19205022c094d725f820b6

                                                                                                                                  SHA1

                                                                                                                                  f8f1baf648df755ba64b412d512446baf88c0184

                                                                                                                                  SHA256

                                                                                                                                  7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

                                                                                                                                  SHA512

                                                                                                                                  3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                  Filesize

                                                                                                                                  152B

                                                                                                                                  MD5

                                                                                                                                  847d47008dbea51cb1732d54861ba9c9

                                                                                                                                  SHA1

                                                                                                                                  f2099242027dccb88d6f05760b57f7c89d926c0d

                                                                                                                                  SHA256

                                                                                                                                  10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

                                                                                                                                  SHA512

                                                                                                                                  bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\337dfc13-0d1a-4877-9949-32a45ee483a5.tmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  MD5

                                                                                                                                  8b711f551343a8bb1c86cd28d1a1b82c

                                                                                                                                  SHA1

                                                                                                                                  e1020eef15f042f340518e395f381d8027415a74

                                                                                                                                  SHA256

                                                                                                                                  e9bf2396064490ec25ec4e29593b911f2d4a97792c0c13b6fe4677d7b8fd8dbe

                                                                                                                                  SHA512

                                                                                                                                  effa5c7ad62d8395702247d89eab72092a3442969c9c78667aa7a401bfd687d79cb5a7628f597fed26ae90bf3317451a66e2f183019196a0d46cf9de36a07ad7

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                                                                                                                  Filesize

                                                                                                                                  31KB

                                                                                                                                  MD5

                                                                                                                                  5a69247e8c86c887d3d1b973c8bff7d1

                                                                                                                                  SHA1

                                                                                                                                  13f0a5c7aaf7847cc3463d0c85ba8720ea012dc0

                                                                                                                                  SHA256

                                                                                                                                  7d628488b5a607df805e9bc059c59cd49125b681f6cc47ad485f627f37f9771e

                                                                                                                                  SHA512

                                                                                                                                  497fbf6aede322dc8eb02ce7407ca5ca48e0d78b671c10372663683d13f79f98e30c6c87a7fe1a971aba64a37ac17f39b30a73f30a296a1240dd9131c33b2100

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                                                                                                                  Filesize

                                                                                                                                  148KB

                                                                                                                                  MD5

                                                                                                                                  ee5d7349d05a3812ff8b0a0db5b3b9a6

                                                                                                                                  SHA1

                                                                                                                                  51c61cb259391be7ea5f1eeb4eee874831549512

                                                                                                                                  SHA256

                                                                                                                                  229a0b3488ca7a7a1436ebc8677d745f39608f19e5456e2912d090a0e56830ce

                                                                                                                                  SHA512

                                                                                                                                  7401c87fad8d305e2b90c5915eef217a479c13cbb0b62b6b8a6571e4f18a61ab6e92e298566c3a44c97356b4ff3d2d6a7b7fe03cb79d85d14fbb68172bca52a2

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  MD5

                                                                                                                                  034d3bc8df893aea9a2684b24ef9188f

                                                                                                                                  SHA1

                                                                                                                                  6887f66119b02cfd1673371d712999bc905ffc58

                                                                                                                                  SHA256

                                                                                                                                  301db5a6f5a4dbb592548c4fcc8734a3dd72a0c56b520f17b424e2be8de2aa43

                                                                                                                                  SHA512

                                                                                                                                  c10745db8b01e00bed7cf3fd17ade6bfd48e6ed771a6d9a5db67142200baa2b7cec25d8d81fd72b892e7b6c48eec2ddd29099e4897767203aa4ff566eb20c772

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

                                                                                                                                  Filesize

                                                                                                                                  251KB

                                                                                                                                  MD5

                                                                                                                                  7a4c6579e85e7687b7caeff56326b359

                                                                                                                                  SHA1

                                                                                                                                  b39f533c843aaefbac0058eafc4e6b6b05d09aa2

                                                                                                                                  SHA256

                                                                                                                                  4ae263098c462e6e6b2243f5a3a69df9de80d09c341c137dac3b7318b2038b50

                                                                                                                                  SHA512

                                                                                                                                  686c78f37b70b6eb8ce3728208cfd280d784511882487284d53da9a34e6ed6e5ac366d0200629c9f77c84899166feeb976b95e8a095a13bd0191665a06b6d17f

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  ca2260a7a6aa9154b7d9e4aaf1fb1e35

                                                                                                                                  SHA1

                                                                                                                                  3499ef350866dea29b97d6514ee72cfd091ab044

                                                                                                                                  SHA256

                                                                                                                                  79d99ff83a7fed6717cc7d3fab8b5f34f642c91f9956114c18a9c82fdf38993f

                                                                                                                                  SHA512

                                                                                                                                  1cec647ce637d3511bf56b74518c44de6255a986516915e525f273906245e9d9f65c7353b8a90de653fd9cf1293fa9c650e5af4617d06438c7c112899e3a9e80

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  MD5

                                                                                                                                  edf7f976a0e30d0d080c8116344841f0

                                                                                                                                  SHA1

                                                                                                                                  19079213325967d1b112adf02ccc1ce6ee595d6e

                                                                                                                                  SHA256

                                                                                                                                  90fed2b7b01dd2bf9db9877449337a28263a7c2c4fe79b49fe6304376afa5abc

                                                                                                                                  SHA512

                                                                                                                                  c992330f560caaba354129b8040849fefef640708df6097fbf1b935cd8697ec71bca34167d1b4338e01c50eede66a61a7ac697c78dbd03d3082f34bf2dfe3720

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                  Filesize

                                                                                                                                  5KB

                                                                                                                                  MD5

                                                                                                                                  088297568271616b128316e0952dba38

                                                                                                                                  SHA1

                                                                                                                                  80c80be46ff7f512a2a2f559fdff12781d5ff7ee

                                                                                                                                  SHA256

                                                                                                                                  0e32804b26fd9f9f77a68638d966d924664c71bb2f42057338731bc78cffae9c

                                                                                                                                  SHA512

                                                                                                                                  132452b6e46b5a3a5906b0a9c066665d57166d452c726c87edcddc9cb5f4b84fb049e3a2554e2ebfbd5994e359d3c5584b348e1de1d32b9881b5f023003b6aad

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                  Filesize

                                                                                                                                  18KB

                                                                                                                                  MD5

                                                                                                                                  9da15306fe535dd0b18d55c6aaf7bcc3

                                                                                                                                  SHA1

                                                                                                                                  3ae866fbae00a9b22b1ecf3761502e0ae2c79748

                                                                                                                                  SHA256

                                                                                                                                  a19420eb449f951e0ff08a9adae27912693200b4226206ccb76235cf1fb11e95

                                                                                                                                  SHA512

                                                                                                                                  1e14b76dfa0a197d09dca3d65f83dc8ec0f1b60f448381488bb55b9dd515a532827e5acb8d2d32a6ea02dd8d2dc8ce724fa71544ddce465bed74fb1d860305ee

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                  Filesize

                                                                                                                                  6KB

                                                                                                                                  MD5

                                                                                                                                  caa4019e639784dfe3b2b7a45b0295a9

                                                                                                                                  SHA1

                                                                                                                                  47cf7a97e283dff2254300d881b8d3134c314928

                                                                                                                                  SHA256

                                                                                                                                  2b0f325aa64ee612713db42e14d40f79e5f72d1156892934f6d99f3682f4ca05

                                                                                                                                  SHA512

                                                                                                                                  f7d82e700ac5d849ef114debd8a8b88edd27342e60dd3efac41ca056c06c3678aa4b0e2b3e5662623692b920a548e1c71f79949a1c087cb79872ece8be788b08

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                  Filesize

                                                                                                                                  5KB

                                                                                                                                  MD5

                                                                                                                                  cbf97b7372bd3606e89e6492a4420caf

                                                                                                                                  SHA1

                                                                                                                                  f9c234e886fdc934ce1fbc1701de2b8f57e935d6

                                                                                                                                  SHA256

                                                                                                                                  e13e438ed6344c853f2173952943549fe32a6cfd0bc8175eb89da74d84777adf

                                                                                                                                  SHA512

                                                                                                                                  2ac013fc44cf5c361516e39442676d2737dcdf946b253706900dc7d65fbd4457c78a4bb6109c147867f890ed2bcae0405cebced082fc72602cd4d62b6fac8dee

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  MD5

                                                                                                                                  8132dd6e45c4ff260a654c43e2b3fbbd

                                                                                                                                  SHA1

                                                                                                                                  9558391c8c06a217388caf7b2185d4b9cd7e46d1

                                                                                                                                  SHA256

                                                                                                                                  a7b68a88e1ed882f6ceb358f1b5b690a5f400a602b589e98db834b2e7d37e162

                                                                                                                                  SHA512

                                                                                                                                  6b8b22474af22b7ac11130399e39a3d01ecc6abc0053d3f641565fa036cf0a5d9440e4da2c1b93f430961945ccbbb448cda45f188b8c42e1adc16c90ed4b8bfb

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  022187b85a4fff81d560b4d18cec2ec1

                                                                                                                                  SHA1

                                                                                                                                  958e0f89696ea17c506f1dbb4d9908fe5c9ef9bd

                                                                                                                                  SHA256

                                                                                                                                  e4c67562ac48ca4113e41bc4666ad9b39de648028a13069d09291ede15f28cdc

                                                                                                                                  SHA512

                                                                                                                                  c4d6bdb34076552dbcf22aba8854936ecc5641b02f55e532b8cd2fbcfbffb8a530dbeb06b010f41295e68be286d5f49ee03d21ea894560a906ecde9a421da71e

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593714.TMP

                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  9eb2a1a722a18084241a3ef79d7e1d4d

                                                                                                                                  SHA1

                                                                                                                                  bcdbed4cb229397b17774ddb3e6c5405cafa9f28

                                                                                                                                  SHA256

                                                                                                                                  b050304dbbc78e36db0748ef01c067a9dd95f1a6cace12322de9fdc1c324fc31

                                                                                                                                  SHA512

                                                                                                                                  05c26c08218435f3fd34323b5319da06a77a009e74df1374e1ac0494b0c5ea74518bf9d62fd87de2650b1890d64cd22d1c3ba126a0fa0691b335a5410d1083e5

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                  Filesize

                                                                                                                                  16B

                                                                                                                                  MD5

                                                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                                                  SHA1

                                                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                  SHA256

                                                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                  SHA512

                                                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                  Filesize

                                                                                                                                  10KB

                                                                                                                                  MD5

                                                                                                                                  4374fe5034f0bc4ca6a10767df3520f1

                                                                                                                                  SHA1

                                                                                                                                  28aef11eee0dfaaf9bf114b31b9e7c498fa76040

                                                                                                                                  SHA256

                                                                                                                                  b5c7b60d6283933197be37af640873945a4ab91dde6680ed5255b4d9a0cdfc4a

                                                                                                                                  SHA512

                                                                                                                                  41d2a1e4082b3793f4e762b7944bf11e8ccea2b1b4bfd7fb0d2e69d0f2b2f62b7cf1d02cfe69d85d401df090cc3dd5d210451d2a9bb00092873713ed6573c804

                                                                                                                                • \??\pipe\LOCAL\crashpad_2416_RXYARBEWXWZVZORW

                                                                                                                                  MD5

                                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                  SHA1

                                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                  SHA256

                                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                  SHA512

                                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                • memory/4928-1-0x0000022BFD950000-0x0000022BFD968000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  96KB

                                                                                                                                • memory/4928-29-0x00007FFF42590000-0x00007FFF43051000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                • memory/4928-4-0x0000022B986A0000-0x0000022B98BC8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.2MB

                                                                                                                                • memory/4928-3-0x00007FFF42590000-0x00007FFF43051000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                • memory/4928-2-0x0000022C001D0000-0x0000022C00392000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.8MB

                                                                                                                                • memory/4928-0-0x00007FFF42593000-0x00007FFF42595000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB