hxxps://t[.]co/gHdmLP7nlZ

Resubmissions

14/09/2024, 13:36

240914-qwdgtsxamc 7

14/09/2024, 13:34

14/09/2024, 13:25

14/09/2024, 12:47

14/09/2024, 12:47

14/09/2024, 12:24

14/09/2024, 12:23

Analysis

max time kernel
867s
max time network
440s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14/09/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/gHdmLP7nlZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
32	wscsvc.exe
852	wupdate.exe

Loads dropped DLL 58 IoCs

pid	Process
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libexec.lib
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRanger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libexec.lib

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	libexec.lib
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	libexec.lib
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	libexec.lib
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	libexec.lib
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	libexec.lib
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	libexec.lib
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Key created	\Registry\User\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\NotificationData	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	libexec.lib
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	libexec.lib
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0000000001000000ffffffff	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	libexec.lib
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	libexec.lib

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MailRanger 2.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\nexusfncombos.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\_roblox_.txt:Zone.Identifier	msedge.exe
File created	C:\ProgramData\wscsvc\wscsvc.exe\:Zone.Identifier:$DATA	MailRanger.exe
File created	C:\ProgramData\wupdate\wupdate.exe\:Zone.Identifier:$DATA	MailRanger.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2100	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2828	libexec.lib

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
2156	msedge.exe
2156	msedge.exe
2024	msedge.exe
2024	msedge.exe
1344	identity_helper.exe
1344	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
3028	msedge.exe
3028	msedge.exe
4756	msedge.exe
4756	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4768	msedge.exe
4768	msedge.exe
3996	msedge.exe
3996	msedge.exe
2572	identity_helper.exe
2572	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	libexec.lib

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4696	AUDIODG.EXE
Token: 35	2828	libexec.lib

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2100	NOTEPAD.EXE
2100	NOTEPAD.EXE
2100	NOTEPAD.EXE
2100	NOTEPAD.EXE
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib
2828	libexec.lib

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4784	2156	msedge.exe	79
PID 2156 wrote to memory of 4784	2156	msedge.exe	79
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 5032	2156	msedge.exe	80
PID 2156 wrote to memory of 3512	2156	msedge.exe	81
PID 2156 wrote to memory of 3512	2156	msedge.exe	81
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82
PID 2156 wrote to memory of 2476	2156	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/gHdmLP7nlZ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffeb1333cb8,0x7ffeb1333cc8,0x7ffeb1333cd8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16327139653284577906,14247937457755105548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb1333cb8,0x7ffeb1333cc8,0x7ffeb1333cd8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2456760154418909745,1590854030881738170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_roblox_.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5080

C:\Users\Admin\Desktop\MailRanger 2\MailRanger.exe
"C:\Users\Admin\Desktop\MailRanger 2\MailRanger.exe"
1⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:3456
- C:\ProgramData\wscsvc\wscsvc.exe
  C:\ProgramData\\wscsvc\\wscsvc.exe ,.
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:32
- C:\Users\Admin\Desktop\MailRanger 2\libexec.lib
  libexec.lib
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924
- - C:\Users\Admin\Desktop\MailRanger 2\libexec.lib
    libexec.lib
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2828
- C:\ProgramData\wupdate\wupdate.exe
  C:\ProgramData\\wupdate\\wupdate.exe lFBwqBK0wQbNerXBgDIishuoC6LUPgm2JLCwpw1VT0VKEvL8hZ7AXawpYpQohCq0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1a36ce46357b9d200e4faaca4bd9d506

SHA1
de61ec5a9466711b5a88a93265e9987a1d2c8f68

SHA256
62f5a99a675dd5dfd6cdeef108246e71adcb5a10f97539d6cc7ee5b4d92cc844

SHA512
eef3fc52b3855c10d6144a76ee0a6cf685f621438f7fb7ecc3d157265c4656283fa8d3c9c2886e578f5eec74470c5c6c43a26786e63fc1ba71f52fcc7c2e3bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b92de3de6e66649aa758943743d1f8b1

SHA1
1ebf5cfc73c7b4ea2d1b404fd679f5cabd9327c9

SHA256
be2d1032ad58f7e80ab0e7acb20df81303665b002b05b0c7f64b478181054af5

SHA512
af8b71c8b37c2ebe8c656cc3d43d92fb029e1887a3d309ccdc46b461047a35d3af0cd3eddbe4c42877f29de83ac91bd0f665abd2f02306c143fa3271819586f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3cff2b23-59e4-4c2d-9c68-b0a994519502.tmp

Filesize
9KB

MD5
ecaa68d7dbf0d388135f88c7006c6931

SHA1
b7b88e28a128817166a2b6e8f1d70cc359db2e71

SHA256
372e37cca5a5c14874f1b72417d05e0e6bc25e607a41da37a8b797339dcf24d4

SHA512
3f93c68e729f8975d0f57852c981728b2db4fc259af0fd555ff7dc2edd744b5837f575aca416331b2cc8ccffe4716521c32c57b8a545414023dad52e1559e0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
42KB

MD5
1e839b4744ad28d6e340113882563fae

SHA1
89cb26bc12ca7316dbfdf0003b8422a1bb1e8e19

SHA256
beb665068f875334f864278e14622ab0228a099461a6d7af43c75272ba158953

SHA512
c2ed45f74099f29d40142d6a71f5b1aacabc362975b78b1289e4a02d317b1e7aba1c093fb1c87c22da63c2883088a00bd9cf8f22572b29719197fd75c536fc2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
36KB

MD5
f90ac636cd679507433ab8e543c25de5

SHA1
3a8fe361c68f13c01b09453b8b359722df659b84

SHA256
5b4c63b2790a8f63c12368f11215a4ffec30c142371a819a81180a32baeb2bce

SHA512
7641a3610ad6516c9ecd0d5f4e5fa1893c7c60ca3ba8ae2e1b3b0cc3a72f7f9bef4c776a1f2fc52f366bd28a419ae3594a6576e886e79a20ebd98b55b2acc967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b77f16d4b31928003e7e8288c973aa0b

SHA1
66f992156e5ed074284d1302577fe360699a8b02

SHA256
efe65dda423cc247c83dd59b56db142b00aa9b1685fcca81a39df6bbd0522638

SHA512
2e600b3508dfe8739d9d6afc0a9d03ce951e99c521edd07cc98614b783381f6b801ecd9b3764d1b3d085e7108fd0bbe30ac4b761fd98d450b13d42fb7f323d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a0d29a9e1360e49e081de77d5f56360f

SHA1
eef90290b669653a97ac96b53d3c9c5433cba2f9

SHA256
eec9640ded05744807a79c7bedc9d90ee31314e3cecb3ad70466a6a360f8c587

SHA512
4d8b9bf2a169e9d26790bac1a147f32af1af79653319ec3c69a1561773613d3908001c2b2d39b284f9a587017184d1208e596bc1199549fec3800021d2e30cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
82a740d5a4dc636630606863fe324e9e

SHA1
b6f80ae3cd7e0dd0f898ea4173c3909d65f46045

SHA256
34b3be8dc83bf67e785cdb8d0f6fa8a05c09e3d6bee9eedc551f225d739e2354

SHA512
de77d72b6324340df3fca5ba02a6dcc21a6fe02c8dde2f30b8bb194731e7310781713e888e028b4314428fc344a1ab1e950ab6d0321ffbaddc09f581d963e378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
706c1696dd36688792e75963c6a98c0c

SHA1
26b8bcc1da4d3092b6c2e5b3f5a04e2b10c8cb53

SHA256
993faf8f1cffb6ecd9cade1465929224bef41772ced7c7a0c4dc9866f6020ca2

SHA512
5cf765ce2383245180245353453695ed0688b9b9997704fa974ce101b9108646b9861779056560c0f8121f99f4aa18fdb10f5648d9cc38e1174a3812dd7178f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
48KB

MD5
c6ed35399ad928c6e83bdc4031920706

SHA1
6d1beec2317edf834c2d00529bd27087421d64b8

SHA256
12ffe62d88c7e9552e21509adc9cfed331326595d691c74b121e913f135da03d

SHA512
8da00ccba7b3810ada89c91c996b1a1053d8573eb88bb10a73e2979ca31aec1f1cbc6af729c3b334e601833a9097241c39538e781fc9da99332bd79727aeb0e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f15d801f66f922d3009b826b6cf557e9

SHA1
671f8ab2261ae1a2333fdff3945d6efe5135a1e7

SHA256
fd348713e9916c04b04ffbc88c6fc46bb6528bcde6fd22ca43792a2c5c88b3e3

SHA512
69c0057937fb15f8f85fc8caa71bb40f356f1685f765ac899ee177cd3dc36b6cd9dcfb049ebe128fcc50a3dcfe3ec2cacf1e56c4df39e2d634b3fdbc1c51e6d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
e0b207e61b8f3977ba1f087f7f64ec70

SHA1
b68012d6542af1a7bffe7a55b20ce1803c375f04

SHA256
92d1870ee7fd217488d27834405ea00231f0604ea881bd2bae156250b3224c7a

SHA512
ed0f4093577e43443db6ac62e00fb7f1b828249286bb6045418bb67014daa5331b7d1d78e19c57b6d485e77a703d9f8952a91ff11edef3a25bb03d4368349296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4295b5dcb2e9cd4755a4d94b14384b34

SHA1
291411baf307e45858560af3627f517721600b6d

SHA256
abf28c2037b613781b48b784150a82bc428674f5422f2d4fc1ae73ee00112481

SHA512
3df874d9c5f7b334624be61d146e26287eecafcb6afe9677d63782b562d416aadc3dd105e321d1f3a1dda749b2bbd55fc5cd171eb347e21af1f57fd8888d53c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
9f45bbbf23072ecee08d5491ea52ec2e

SHA1
6e19e60579e115b6e922b01b8d53d4b6fd84d73e

SHA256
fa2b221dc78c1413696cf874cca6236e84d40d4426c90ebb31db13f6129ffe10

SHA512
69622cd99099a3202ec4e3c02552e3d8d281048bdbca0db10d518559556068ae63ef3ffbff20fb1ac2ec91f8aa6da2763aa5af58d233154fbfcc89941dd1755d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
e8e18f74c1fa58457874b624b9f896c6

SHA1
9082a3d12f9a499263452002a01165a8f545aad4

SHA256
1031741de0d072f7199f56f0f4cfe5ba562bec8fcb16339c90725dfdf9263650

SHA512
44ccfca67cb8d61b9d3295824fd92e3e82a58b6e75fe9feb3ea5f05c763ebac82a8c3f7ac2e2f3cd159255c0f6d6f777bdf5358beee6fa03300a1b16c192c1ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
bcad79ff869740d4abc63ef9cb355d64

SHA1
852c3866622d8fbc4c147c96cb1f7b9967cc5788

SHA256
90839a4fb7799836519875dd5f23ce13da2efb943f2896df665b8cfbf121bb19

SHA512
76f6e6dbedbd39fae3a84b9eb227e3f83f79e710299d724ddef157de83d8c93844379a8435104c3e5dabd2f4378d3095ad700da347b15a86222d03b46fee65ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dac900ecaab775991839c22f72043502

SHA1
b5a16042ce9510882df8ba9d52f3b2b1115a4158

SHA256
46b5c2d5b551c05f0bb4c517bc9850ec465ac3f589ebbd681a39ec66b6d8e6ff

SHA512
1a8b2da99e281f32c949afb6c5ec37d94384bd19ef454d4198b66bbec1f82c3195923360d2ffb60b81ee905523c104fd74c0d2ab62c1fac99551210a7161ec08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7a9ceebbdb1a41ce68e7d5f5b706114b

SHA1
64ed6248e3c11c997960640b280a6bc52f79878c

SHA256
475dbe1068459664936a52c62d38a3ba4630a7fe730c01b95a6dd8a9587957f4

SHA512
300861849658d01cc104d39ab5c3ce75205fa4718cc0730873ffaddd525d4af529630b7510b9a51246052d39c2a4cd6795287cfa63cc9ca032930c89ef25a625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4970cbada1a2ffc525e2da0b95afeac

SHA1
2d36cb970d5afcd21a3c98e8d61be1f1946a5b9b

SHA256
957d940df55cd96a710e4717480bc12e0af59d99e8f24b78853280ddd989aaea

SHA512
d06e21921462e9ee18d2e21049aca71115ade76efa024a7e783c22bf0228ecf16bf04617fd1aa729acd229e4f28f34e8f9a9a2ffc750e1a2ee187f836fb05b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
265556ddc7adb86f86a2d85d90b5641c

SHA1
9b62bf43da57f302ec5f09f3253d10491ae771c4

SHA256
baa5d484781c05d59f923cf43b2dd6c83c764320358e021bd5dd21b8d2d77623

SHA512
bc6f297691d363a8cf57618368364a9a7e3889d7d09c6c7caf6c0210b885d60b1fa08a05adfd443f8dca66221fb1bd4199385f6ef27720ab1278fcf34a70bf2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c115af75dad9d19ab5883578ac432dc

SHA1
12f21439ebdf11753d5daf6cbbf1d0a943ebbce3

SHA256
4edd60962df09ef843eed86f57df7d0d5bf1100b0a22370d14d95aef758039f2

SHA512
7ea5676ff09617ac2d1e4bf3b0756a636fc537b940a6ef7308d17a7c76b9dd629b67df377b690f0f95e1444ee7875e7d79da8b84f3a79560349780b70094815a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0ee09ffb04b0ede6c525cbbd17d99c40

SHA1
2d7cb1c6c7a4b2316c51af6149cd39e6383076d3

SHA256
c229163c3bbeef5718d16dad693583953838a8b588e910247d78403572ce7f70

SHA512
b01cfc2452c01de3d0985aae1b14cd012bc0922f14048c78a3838f192a65d7c6670ac38c7fa3cd041e6ce2da13cb28916c1df6e051ae316c871e3d8c74751f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0ed28013db9770dd70c2ab148333517f

SHA1
c512e987f3c111260e103cef71595b0a29e302b2

SHA256
36309fe1d2db6f5d09a30d9c46928bcd7b05ef017d7d41768d20449617dd8163

SHA512
a1b05df36e15dcf3be60709f877167ab4654902e50a178104ceb03708c743ed601838a7f5eabc7cc9901283fe8def74f683524610d62fdd7a369a5ac9b3fc86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b9321c9e8609a2a53495749adc00bb7

SHA1
2504057b5d4bf1f7c0ce5243020065018e7c7ced

SHA256
f24daf91f67be96607bcf7d6eb331a63c613a32efbb921b39dfc17dc7b9b0ac9

SHA512
7c2f91ae5f9df2b55f7d1ba55ceaf1b1610276d5363938e596cba9914e1c6cc9e97e83e31c795136f05068e47ba19a07801a8fb6aa190373fd6896b2eac44804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98bc087ac4fdf41901a9d33bc0be51a0

SHA1
7d8d3a4a38213928ce53f136d24eb17bdb57548f

SHA256
c71a941d2baa5b7d92a963da2da1d196b88c88ccb08d0556ec60514e1832ecfe

SHA512
2b51a3dc0892ea6ef43f79df049a24471170194cfe4e1c57d90a181de5e6335dbcf8fcf92d97f32da6f3e0106e3b506bdf717dfd9c223034657d982b2e0d0407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2da23467f2ed1c325761e2ed749b2741

SHA1
e946f7a5374eb69bdc404236e13788f77742795b

SHA256
b7c9f9158ad7e10facd71f24301382db5d32cdc655c3c4d3004992b09baf3d11

SHA512
e8446cbe5b61387ca81b2bf3602c113bf9faf80297c0e7a110fcb17d0bb3081902a77006b8996322a5257904336181464e96ba5103882e01e9be2df5fede2d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0f168f68a8059d1a05cf74d1a4b73e30

SHA1
b8f5e2c155bfea3f84c374f2971d0d502607ff78

SHA256
98137b772034f17a9260fde8e7384bfbafcaf949b48f7493a1ee18c05303ab7c

SHA512
0370edfec4703bf356cdae5889b9df3917dd4226501cbcaff95b6fd880578c8001d9bdc69610ff90009376713abe5d256b876bca1e2206362ab3c6ea0093943d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ef71.TMP

Filesize
48B

MD5
861b441379f98166223299fc301ff221

SHA1
163812dc6ea1f2a7b55c25ee7420d412b98c3132

SHA256
2851b8050a6e54761d089156088a126c394d747983fbc99b4095010200be9944

SHA512
bf46035b391181ec4315673e78e202907746c8958be8e71641b3ac4c40ffe53074090b83a7cdbef445364bfdddd5034098a7504d1e7a8fe660209ad688de74f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6805bda5c45b76f54d9e3df18af85c1f

SHA1
4caf511243592cedeefbfdd3fa74d6e2cf22d275

SHA256
4dabd8e38c079859302497de91ba0f4bb6c290f88b7064e0d2b35cd9acbd356e

SHA512
bfd107c3117dbb37085cadd15abfdae82836ac15d88ddab65e9649bfa68daf1a72a9041f30be524a4c4fd41503181899e110cd8fbbd19f2fc338dfd8d57c130c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
76f79fee36511bfd4234246beaa5ea25

SHA1
a2f50b7a21d56278695990e9d987792b9c0c20e2

SHA256
6db9d25b1d0ae69894cba1e025f3c30ea7bea81fdf207d6f037082ad4ca15f96

SHA512
947ebca1b400ddefe30b0ea29d036b116bf1a6ffa6a34bc000e4d88f8b3c4ff19314c149d9937a811fb195de360309e47c2f439bed3f5be24751a929c40b6c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fb0ae5ed5336570307adf4293d3827a7

SHA1
066d9b7760c55be81cbd119bacf3dadfbd73d6cf

SHA256
56647cda9c5be5f0efa9bcd9f2113f06c2ed714afbcc1ed30cf2d3e8ffeda4a9

SHA512
c5bf394eba93bddf78ddb3e42e3cb322eab012d88697499e588df87c7e6e1d66432aeb89f5b46b6625d3a8497f56ca07cb24bba71db073295b74ffca4cceae7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
40e9c5c062d4e3cb4525cca8f0dd8d3f

SHA1
15158204b942c0ad7d7654e4ef78640fc6aa36fc

SHA256
ad99d6134904f03de48c96f04d4db55dae273c56fabe2f1762ea5df3e3b4736f

SHA512
c7e0ac3190b94693647ba69c5744011960db768f6e3c40ed6ff389134af2cee6173d0487ed2f98b1087e4eeb2e04f0eb442b276ba927f5134b58a4d4dcda904d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581cda.TMP

Filesize
203B

MD5
ef372cda7147e2cab4f0385d7c01e8e0

SHA1
0f9b132232acd3baae4f56c2a751ac0051dda96e

SHA256
c65e30595453dc608b00fb4d665819b163081bb018dc56a680e749baaff8d157

SHA512
3c81dae33ee4aff5e00d8d35f03a3c4d8990bdb613b0882748ff4dc8aa986881e638c4860fbc3be7c0e959fe54a3f9966db48f8d021512872288e4ebcd7f06fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
89c66a54ba949f55da134320c1476ba3

SHA1
c4113d9e9ee3db733ab00e4ba72e0ed8701bcfe6

SHA256
ad7f10b6cf632686a5311199acf98da492f8c2f152ac321348796b13078d7545

SHA512
d622e7e7ec816f9675cdf201f52d7b825e9183df1ce46807520ee6402203657892a52f169ef59a48f8c60a1f230cccd0403acdfa56e96f018bbe7071f8d8eb52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
daaeac495705a31672389601799fcd30

SHA1
5c1ef7842a3f987901fd71e9bbeef71157ca96c3

SHA256
70de3830de12cede574faf714f0c3f7527236f6c1870d46e46effae12d59e0da

SHA512
bd946eccae9d649709353a301147e249a40eeeeb74734fa5e5e554d37d5568516a260bd3be7f58a122e072483ed9b1509c14eb16d0b775b4c4f10d1cad8f813c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e927ea734438cf6af0a53e05ffcaa00f

SHA1
d4511afb4d545fdbd76b5130ea9f234fc58a33f6

SHA256
557ce2480bbb5d3852631c0c4b2a61a05a43ee40e2e8d08536719f251fe04e69

SHA512
b13cd743b9bdb9c86fc753add164e4273d71394039eb5419f8e955a3bfe3fa9ad5e202985f436aeafdb818d4b2d6db6be829440769df691ec99db4827627a306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b582b7fdfd9af4d04d90dde28fc945c5

SHA1
33b2f672cdef79814464246aff07c21c56d6d3c5

SHA256
75664f58929c62951a6caaa677fd4b635b4b70ac145029e92db5c960bd47c891

SHA512
66aa2b91127074918189a47445b7ad7d79dbfa1e1f77048cf2ce728ef25e892e79db005cd144ae4904325308eb292abf4618088af38bfe53b3048d6a1f525dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
517f69942ad519bcf6d39293cedd9591

SHA1
54b75cafa7cf712580b07ec39504298a6c8cc3db

SHA256
f1986aa5cce6f217500cf683844cad5c22cb8c4ddad50a346bdb15e12e62f615

SHA512
b737ac458870f92e158db82ab09de775c3688aec5e03bd25f776dfb4507f2a44717349bb9e7a048cd5bbaf8f66a72982ff74f9c87b6ccb1af2cc6abe7258f77d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
d05cabd95adf2b75b57090ffd790e78a

SHA1
42190a407fb90f1e804bdd3bbdaf2dd0504f248f

SHA256
3633d6f9a1547a94e6091125ab90b322134bb150a11ee57dbaceff239cb82599

SHA512
d9ae551e7ba3a550a52577eb3c97496f896379a0b2a3d2b80dce7885b55551fa131a5cf03c428c93ee5daaa340130601c7242590bef6dbab20c74f82297f3739

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
f5d4e5ddc2ad43c06b0817f1cd96dcba

SHA1
7942d7da5e056b81fc8e5208f58932bb99f97e95

SHA256
74df0aa1a67754acd1162bdc307fd7fd6174148eef29c19fa17ab4c255649d79

SHA512
390e2db79d0bfe8f9af3bef86beaf2c1fd4dcc3c451f55bc4954a7ef44b3888cc4e765a5870c77be866f2653d6eac9f3969f9185a32824aebac900db86479c78

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
28501c33c8a4809722731a3500f98fbe

SHA1
dfde8337a6ac7aab5ec3fdfa0f7b9b193cdf2e56

SHA256
f5bc9bfbac98129640bb8339ac718e21eed71e0b2dbea3546d9dbb46393fb487

SHA512
3fabdd5e2b98b21c7d2da7c224dfe332cce1a86ec13d7eb6a0c6b9862f2fd4344b499db469b11410898ef513f0a02619e62d5141c0fcb933c1739f98bdf6fd76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
8a9679a03f7b433e1c55b10528c441b8

SHA1
232f2b62746a8cb683fcf8206426e43d6875ec4b

SHA256
5a5e947825a35a238cb1b079505992dafece36609002a98073182a34674fcff1

SHA512
92e19bb0fcfc48328d53f48cfdc7b41408169c3602ff98235c67c62ed1d09bc318264aa243f20532df8da5408e8129bdc1c6a4254835ebeffd2b78194d51a7df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
0ce2cad0a77f365d23883acdad71a440

SHA1
bed4e73996fe6fc64b6e54f89765c137bbc5619b

SHA256
39b7adab84038ee3b4dbe2e4f2d1997b0f42162643b2f30240389209753de856

SHA512
d7deaf70798d447d848ad7000eba86de67f41191a84a39dd4ddd3b529f5cb4218fc133bf0c2529b85fdd660356a34e6188049647cdedb6fde908538e4c25dd5f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
8507221101906fdbf1d8237a1b4c942e

SHA1
1180a6c1b54aa734cef16d2b8e871ccffb2e4e00

SHA256
995d613953f04f6096e917673c3e28817a031f4113ef2e418d10c4e61ee7daf8

SHA512
e74da77174c4dd6bf30db8029ce4da66a2bc0ff1bbd682d3029e106f6b1439d62408d15f163b59612559945771c6b726693df2482194fc4ef1472d4f59b44b87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
c09a79afc83986ab3b51a9f1930cd7f4

SHA1
e49170f42325fe2f4516cce6599ebe549c07202c

SHA256
2934c2fab4ac3c30f7c470fcfc11e2479f626cd6e1ccaf33ddc04e83f5f1346c

SHA512
02230c21155b49499b76fad2d126e13a55b4ccae9753868f0dba6a13927df71c0bab3f3479926dd3e3a7f69f4f16f9a80d0dfa3fea9f48fff0b47cf60842622c

Download Submit
C:\Users\Admin\Downloads\MailRanger 2.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\_roblox_.txt

Filesize
991B

MD5
6b6a1b404ee635a5e54be28e89906804

SHA1
313cc940f99829ff17a50d0dc3a71e207d3ea787

SHA256
879c3d2c56b20bc8dd861ec7b96b68358e1adf543b610278849d7a84d9c19e6f

SHA512
85e112ef4e80ccc16a7ee4de21b853516aec4ce8055e91d8b870c327b83ad9fa6657d3d624320d9f6da8abe56dd2cebb58ecb7e9dbe37a54515cf8ba07772629

Download Submit
C:\Users\Admin\Downloads\_roblox_.txt:Zone.Identifier

Filesize
177B

MD5
39a3bda6239122bc59fc0da72b1247e3

SHA1
3e4c6dfea4d15245ed4235ecf412669cb11de17d

SHA256
20f2533070ebc12f149092b8cdd37d9f262a2ef9242281e7290ab3ff577cd212

SHA512
c954953c23479e797899e3d21fdce8509ef40a80280c7bf067795a72166ef0fe020afecaf1d6abb95b863b53f8e3b2c2cf086b1b39d417c882cd48427d7db203

Download Submit
C:\Users\Admin\Downloads\nexusfncombos.zip

Filesize
18KB

MD5
e43328ffdee3856557d3e930923030a3

SHA1
c0c5a0c7e08d8af5aa3459a0ac0baac40fa09ee6

SHA256
42fbcc06a9f52c416c2973420e06497d8f5670056b86cdc446e650ef04bd2928

SHA512
8ed572489104f5182853e30b8cdd5e21ce6bab334d79c802099595324b02e2487e9ff3adfd7fb56a282d1952b1206a4893ab8399aa9797b0bb7ffcc452b13c25

Download Submit
C:\Users\Admin\Downloads\nexusfncombos.zip:Zone.Identifier

Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit
memory/2828-1706-0x0000000074210000-0x00000000745B8000-memory.dmp

Filesize
3.7MB

Download