Analysis

  • max time kernel
    274s
  • max time network
    276s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2024 04:55

Errors

Reason
Machine shutdown

General

Malware Config

Extracted

Family

crimsonrat

C2

185.136.161.124

Extracted

Family

lokibot

C2

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Downloads MZ/PE file
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 20 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 1 IoCs
  • NTFS ADS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://w
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c6814718
      2⤵
        PID:1648
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:1164
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3256
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
          2⤵
            PID:2364
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
            2⤵
              PID:592
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
              2⤵
                PID:4984
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
                2⤵
                  PID:440
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
                  2⤵
                    PID:2604
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 /prefetch:8
                    2⤵
                      PID:3592
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1840
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                      2⤵
                        PID:4392
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                        2⤵
                          PID:1876
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
                          2⤵
                            PID:2984
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                            2⤵
                              PID:4856
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
                              2⤵
                                PID:3312
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                                2⤵
                                  PID:2140
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4964 /prefetch:8
                                  2⤵
                                    PID:4324
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4016 /prefetch:8
                                    2⤵
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3296
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
                                    2⤵
                                      PID:3352
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
                                      2⤵
                                        PID:1848
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                                        2⤵
                                          PID:1284
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
                                          2⤵
                                            PID:5008
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6228 /prefetch:8
                                            2⤵
                                              PID:740
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
                                              2⤵
                                                PID:3820
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
                                                2⤵
                                                  PID:3368
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
                                                  2⤵
                                                    PID:1996
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
                                                    2⤵
                                                      PID:3212
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7228 /prefetch:8
                                                      2⤵
                                                        PID:1716
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2672
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7136 /prefetch:8
                                                        2⤵
                                                          PID:3136
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7356 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3384
                                                        • C:\Users\Admin\Downloads\Hydra.exe
                                                          "C:\Users\Admin\Downloads\Hydra.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:2464
                                                        • C:\Users\Admin\Downloads\Flasher.exe
                                                          "C:\Users\Admin\Downloads\Flasher.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4896
                                                        • C:\Users\Admin\Downloads\Flasher.exe
                                                          "C:\Users\Admin\Downloads\Flasher.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:696
                                                        • C:\Users\Admin\Downloads\Flasher.exe
                                                          "C:\Users\Admin\Downloads\Flasher.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3832
                                                        • C:\Users\Admin\Downloads\Flasher.exe
                                                          "C:\Users\Admin\Downloads\Flasher.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2528
                                                        • C:\Users\Admin\Downloads\Flasher.exe
                                                          "C:\Users\Admin\Downloads\Flasher.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3804
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6724 /prefetch:2
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3028
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
                                                          2⤵
                                                            PID:2472
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1076 /prefetch:8
                                                            2⤵
                                                              PID:3728
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
                                                              2⤵
                                                                PID:1060
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6612 /prefetch:8
                                                                2⤵
                                                                  PID:1160
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1220
                                                                • C:\Users\Admin\Downloads\Lokibot.exe
                                                                  "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4884
                                                                  • C:\Users\Admin\Downloads\Lokibot.exe
                                                                    "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Accesses Microsoft Outlook profiles
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • outlook_office_path
                                                                    • outlook_win_path
                                                                    PID:1568
                                                                • C:\Users\Admin\Downloads\Lokibot.exe
                                                                  "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3520
                                                                • C:\Users\Admin\Downloads\Lokibot.exe
                                                                  "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1496
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1916
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
                                                                  2⤵
                                                                    PID:4980
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7460 /prefetch:8
                                                                    2⤵
                                                                      PID:3112
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:2120
                                                                    • C:\Users\Admin\Downloads\CrimsonRAT.exe
                                                                      "C:\Users\Admin\Downloads\CrimsonRAT.exe"
                                                                      2⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      PID:2152
                                                                      • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                        "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:4940
                                                                    • C:\Users\Admin\Downloads\CrimsonRAT.exe
                                                                      "C:\Users\Admin\Downloads\CrimsonRAT.exe"
                                                                      2⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      PID:1220
                                                                      • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                        "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:1352
                                                                    • C:\Users\Admin\Downloads\CrimsonRAT.exe
                                                                      "C:\Users\Admin\Downloads\CrimsonRAT.exe"
                                                                      2⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      PID:3028
                                                                      • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                        "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:440
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
                                                                      2⤵
                                                                        PID:5720
                                                                      • C:\Users\Admin\Downloads\CrimsonRAT.exe
                                                                        "C:\Users\Admin\Downloads\CrimsonRAT.exe"
                                                                        2⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        PID:5828
                                                                        • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                          "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:5892
                                                                      • C:\Users\Admin\Downloads\SporaRansomware.exe
                                                                        "C:\Users\Admin\Downloads\SporaRansomware.exe"
                                                                        2⤵
                                                                        • Checks computer location settings
                                                                        • Drops startup file
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • NTFS ADS
                                                                        PID:5952
                                                                        • C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                          "C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5516
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\US8B0-24XET-XTRTX-HTFTO.HTML
                                                                          3⤵
                                                                            PID:5572
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c6814718
                                                                              4⤵
                                                                                PID:5200
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
                                                                            2⤵
                                                                              PID:1480
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
                                                                              2⤵
                                                                                PID:5152
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2724 /prefetch:8
                                                                                2⤵
                                                                                  PID:5312
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4212
                                                                                  • C:\Users\Admin\Downloads\Petya.A.exe
                                                                                    "C:\Users\Admin\Downloads\Petya.A.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:924
                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                  1⤵
                                                                                    PID:3736
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:2100
                                                                                    • C:\Windows\system32\taskmgr.exe
                                                                                      "C:\Windows\system32\taskmgr.exe" /7
                                                                                      1⤵
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:4944
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                      1⤵
                                                                                      • Process spawned unexpected child process
                                                                                      PID:2144
                                                                                      • C:\Windows\system32\vssadmin.exe
                                                                                        vssadmin.exe delete shadows /all /quiet
                                                                                        2⤵
                                                                                        • Interacts with shadow copies
                                                                                        PID:5132
                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                        bcdedit.exe /set {default} recoveryenabled no
                                                                                        2⤵
                                                                                        • Modifies boot configuration data using bcdedit
                                                                                        PID:624
                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                        2⤵
                                                                                        • Modifies boot configuration data using bcdedit
                                                                                        PID:5880
                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                      C:\Windows\system32\vssvc.exe
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2500

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\ProgramData\Hdlharas\dlrarhsiva.exe

                                                                                      Filesize

                                                                                      9.1MB

                                                                                      MD5

                                                                                      64261d5f3b07671f15b7f10f2f78da3f

                                                                                      SHA1

                                                                                      d4f978177394024bb4d0e5b6b972a5f72f830181

                                                                                      SHA256

                                                                                      87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

                                                                                      SHA512

                                                                                      3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

                                                                                    • C:\ProgramData\Hdlharas\mdkhm.zip

                                                                                      Filesize

                                                                                      56KB

                                                                                      MD5

                                                                                      b635f6f767e485c7e17833411d567712

                                                                                      SHA1

                                                                                      5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

                                                                                      SHA256

                                                                                      6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

                                                                                      SHA512

                                                                                      551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrimsonRAT.exe.log

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      2d2a235f1b0f4b608c5910673735494b

                                                                                      SHA1

                                                                                      23a63f6529bfdf917886ab8347092238db0423a0

                                                                                      SHA256

                                                                                      c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

                                                                                      SHA512

                                                                                      10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Lokibot.exe.log

                                                                                      Filesize

                                                                                      425B

                                                                                      MD5

                                                                                      4eaca4566b22b01cd3bc115b9b0b2196

                                                                                      SHA1

                                                                                      e743e0792c19f71740416e7b3c061d9f1336bf94

                                                                                      SHA256

                                                                                      34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                                                                                      SHA512

                                                                                      bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      ecf7ca53c80b5245e35839009d12f866

                                                                                      SHA1

                                                                                      a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                                                      SHA256

                                                                                      882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                                                      SHA512

                                                                                      706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      4dd2754d1bea40445984d65abee82b21

                                                                                      SHA1

                                                                                      4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                                                      SHA256

                                                                                      183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                                                      SHA512

                                                                                      92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                      Filesize

                                                                                      64KB

                                                                                      MD5

                                                                                      d6b36c7d4b06f140f860ddc91a4c659c

                                                                                      SHA1

                                                                                      ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                                      SHA256

                                                                                      34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                                      SHA512

                                                                                      2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                      Filesize

                                                                                      67KB

                                                                                      MD5

                                                                                      929b1f88aa0b766609e4ca5b9770dc24

                                                                                      SHA1

                                                                                      c1f16f77e4f4aecc80dadd25ea15ed10936cc901

                                                                                      SHA256

                                                                                      965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

                                                                                      SHA512

                                                                                      fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                      Filesize

                                                                                      19KB

                                                                                      MD5

                                                                                      2e86a72f4e82614cd4842950d2e0a716

                                                                                      SHA1

                                                                                      d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                      SHA256

                                                                                      c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                      SHA512

                                                                                      7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                      Filesize

                                                                                      41KB

                                                                                      MD5

                                                                                      3fa3fda65e1e29312e0a0eb8a939d0e8

                                                                                      SHA1

                                                                                      8d98d28790074ad68d2715d0c323e985b9f3240e

                                                                                      SHA256

                                                                                      ee5d25df51e5903841b499f56845b2860e848f9551bb1e9499d71b2719312c1b

                                                                                      SHA512

                                                                                      4e63a0659d891b55952b427444c243cb2cb6339de91e60eb133ca783499261e333eaf3d04fb24886c718b1a15b79e52f50ef9e3920d6cfa0b9e6185693372cac

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                                      Filesize

                                                                                      65KB

                                                                                      MD5

                                                                                      56d57bc655526551f217536f19195495

                                                                                      SHA1

                                                                                      28b430886d1220855a805d78dc5d6414aeee6995

                                                                                      SHA256

                                                                                      f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                                      SHA512

                                                                                      7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                                                      Filesize

                                                                                      88KB

                                                                                      MD5

                                                                                      b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                                      SHA1

                                                                                      386ba241790252df01a6a028b3238de2f995a559

                                                                                      SHA256

                                                                                      b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                                      SHA512

                                                                                      546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                                                      Filesize

                                                                                      1.2MB

                                                                                      MD5

                                                                                      40dfe9f3e652636dd931a0fec08c9175

                                                                                      SHA1

                                                                                      3c70a06e4f54814239a24705cfd898e1add5cd7e

                                                                                      SHA256

                                                                                      d63e71358bf8968233b6ee1d32ddaacd79edd239e5775503167ab90e375f1ef6

                                                                                      SHA512

                                                                                      42ca2709a80d37c6125038d2ea81d75ae23f4a742fa30c47344a2a757125a02747e7b7830261f58b2064041fe51a3313796088e1daf48884d10a7d9a5672be93

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                                      Filesize

                                                                                      37KB

                                                                                      MD5

                                                                                      1b6703b594119e2ef0f09a829876ae73

                                                                                      SHA1

                                                                                      d324911ee56f7b031f0375192e4124b0b450395e

                                                                                      SHA256

                                                                                      0a8d23eceec4035c56dcfea9505de12a3b222bac422d3de5c15148952fec38a0

                                                                                      SHA512

                                                                                      62b38dd0c1cfb92daffd30d2961994aef66decf55a5c286f2274b725e72e990fa05cae0494dc6ad1565e4fbc88a6ddd9685bd6bc4da9100763ef268305f3afe2

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                                                      Filesize

                                                                                      21KB

                                                                                      MD5

                                                                                      be89131819117173abec1e1a375f1ac4

                                                                                      SHA1

                                                                                      94537cc74677b671d9cf475b57ea11518f4c84bd

                                                                                      SHA256

                                                                                      e85deb52f4f7aafd50e84d48f26c6fd65dd58c42adfc0c6f7cd043d93fba2e93

                                                                                      SHA512

                                                                                      e2f033b4df28a245d3fe023db83ee4c3f9c64904ddbaf3880a0b429548ff6d7074f2bcaa0396042d361780c7f93a51e1f8a0de4154dbdf721cc6078ad9f29e5c

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                      Filesize

                                                                                      37KB

                                                                                      MD5

                                                                                      3ae7a1fc24a2fc360d0911d5074311c9

                                                                                      SHA1

                                                                                      b94f593d8789e38908e86e75bf5d4795fa14f4d7

                                                                                      SHA256

                                                                                      3e687d87510e90e494e83e1f064cc388577ff85bbf9798044ccb2c274b0ee18c

                                                                                      SHA512

                                                                                      c82aef8ad194a149f55549e7ac903bb18601ad765e63aae0550feabf6699bcaef604be165639979e65bc9bd1fc680d67a76ece63b4338148bb2ea6a5a731bbb1

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                                                                      Filesize

                                                                                      18KB

                                                                                      MD5

                                                                                      2e23d6e099f830cf0b14356b3c3443ce

                                                                                      SHA1

                                                                                      027db4ff48118566db039d6b5f574a8ac73002bc

                                                                                      SHA256

                                                                                      7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

                                                                                      SHA512

                                                                                      165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                                                                                      Filesize

                                                                                      24KB

                                                                                      MD5

                                                                                      e9085bbce2730ad18477a5e6b2a053e5

                                                                                      SHA1

                                                                                      81b04f132e7c01d796d1730cace6a922eed47c5f

                                                                                      SHA256

                                                                                      0d3da8c2f0f202ed280cfc0ce71a43264f3793e1f7d5a837822ebed5ee1af188

                                                                                      SHA512

                                                                                      80f905992a6be57b31da4e63f69674a2c9a3c3f0e8c182103afd12d60d689936c5ac76a32bc809b672c564b9b65f1608960be800e72ce058842c698d1bea9fe8

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

                                                                                      Filesize

                                                                                      53KB

                                                                                      MD5

                                                                                      cfff8fc00d16fc868cf319409948c243

                                                                                      SHA1

                                                                                      b7e2e2a6656c77a19d9819a7d782a981d9e16d44

                                                                                      SHA256

                                                                                      51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

                                                                                      SHA512

                                                                                      9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                                                                      Filesize

                                                                                      59KB

                                                                                      MD5

                                                                                      d5da1cc03ddee197a316010d5c41df05

                                                                                      SHA1

                                                                                      39a2021e9daacf3c6f1f8146dc788a7968a3442b

                                                                                      SHA256

                                                                                      a114702bef93ef5d0518d242f5ea247ff4072ceb7eea451e5681e4b4e7387ae9

                                                                                      SHA512

                                                                                      5cc05a34e9eec5e901402477e41a7263f0f02a8f31fdc06b08e0453e7ad50f55717f230a5c992bd1dbef8168c8b69daa2d2982a29449329a0cb207d14bc8fad6

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

                                                                                      Filesize

                                                                                      144KB

                                                                                      MD5

                                                                                      521af33c55174ecf75a05833f8109ff6

                                                                                      SHA1

                                                                                      897f21eaffb962d3c805576d06f07c820acd18b5

                                                                                      SHA256

                                                                                      a3c75bd51b37662153258f638dee394ec4f7be139bf3844e9166f937aedd6324

                                                                                      SHA512

                                                                                      88b44345081129b9c9a4b81a6a83fdadf93f4ce9fa236f8befbc172fecb649ade758466e2c44be30f987915477a9f4abfcdbd1baa67932821b861dfc6f83e682

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

                                                                                      Filesize

                                                                                      20KB

                                                                                      MD5

                                                                                      e81e6ee2a2437491435d0be4f4a6bd6d

                                                                                      SHA1

                                                                                      5070881fe9886694f92ad5db9ef4a931d5444ccc

                                                                                      SHA256

                                                                                      2176a2d4851cc89a9924514ce5d7a0808d5c009bcde0f4c97c03f3c9c073097f

                                                                                      SHA512

                                                                                      af6b56725f125a25f36e442317b0cf68ecc44eee34c3955c0f5c21cc023ac036942f8e4a89b9b1c04796e8304ba43598dd5fd643abc9c06f47d558ea5c531e2d

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

                                                                                      Filesize

                                                                                      69KB

                                                                                      MD5

                                                                                      23f3fe977c11ed9c6a8763950d58c19b

                                                                                      SHA1

                                                                                      bdf5fde1dd97e7a6d426081dbdb4722d3c595bef

                                                                                      SHA256

                                                                                      0304e350ef79b8dac8e841d9a4b5e1796d1d3a71d50831937a55ff12e9d0def7

                                                                                      SHA512

                                                                                      ec656d70675b717eab7bbd1043a731cff1481f2a83221de8c6ad523b35b25ea11614af1558e56c0f804ddb3f2be61ae788fb3f0ae5628ad770df98177c12ec52

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      e76a644cedd50e7a227b91ef5006da41

                                                                                      SHA1

                                                                                      84da7a61a1ffb1497707185daf405f98201428c5

                                                                                      SHA256

                                                                                      892cada405bdd6cb2dd7512446ccf67a59e14c05d9e72354d5c9a32cf5789356

                                                                                      SHA512

                                                                                      fa969c282969fbf1e6447fe77831374ef9401b443bd4f3a2be552aa24b189c35625a5c0843a2f4a20876ec69a176925ce1838347cfe949f33a2d0c54774b757c

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      a16b4227e55883194cc1f1d5eefaa9eb

                                                                                      SHA1

                                                                                      993caf38722314ce6a891d69d371e3160eff6a9b

                                                                                      SHA256

                                                                                      3bb744ca4b4f49b6c9ce54ef0fc1bcd4777b5d41e6f878ebdc4d306b0730e018

                                                                                      SHA512

                                                                                      53129a1ff59af8b4e63258bc7755aa12cbc56f9bf6908773235de2714ed901791c5390c512fce71d6ee59a39d57f66ee6992bfd41cdf7dae136b805233cb0db8

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                      Filesize

                                                                                      867B

                                                                                      MD5

                                                                                      dddb9949b5fcf8a7b9ae8c08a11febcb

                                                                                      SHA1

                                                                                      a9968a4b5e64747ac99820a3c2901bd19650cda8

                                                                                      SHA256

                                                                                      34a24a41741183e20e899be03919dabc6e81d7b58b1f2afd6e78922c9c9bdc6d

                                                                                      SHA512

                                                                                      e6b79c6026929c1ffbf47e4de190c293e6e48f81d3cef9be2da066232249545fa7b8457b8a9f5db4b0cc8ff03ea69611d8743c74228cadea54fe8d46a496148a

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      cc6b6ced2838fbf33df2e43ce814406a

                                                                                      SHA1

                                                                                      b0cf7e618b601a535b9cd6e87a686ccb135e0a0f

                                                                                      SHA256

                                                                                      ceb6c34e1ee6a55192a3c4fa40a7ace4914ebc9bbb254708f3b2219cbbd906da

                                                                                      SHA512

                                                                                      5219643380aceb3c9766702493469f5d1338a93114488370959c996bc1d88f852a4f85fe31083053d572f7ec1824121ecbfaa20107b380a4627e47c3990838b8

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      a4c8dca6e307283a3c9480a6b5668485

                                                                                      SHA1

                                                                                      31646a0f7e88d698f9b554066075d7803d35bc9e

                                                                                      SHA256

                                                                                      33e9e4c16c97e2dc377a34ac041ddbc1178c0d1e886315731afd671a1c3f5d4a

                                                                                      SHA512

                                                                                      47f4c677df2b1e6d564465e4e39504e6d389fbbd88be15315b66f0d8e62deaebcdf3425f41271a6ffd3ff840d1c5377add293ab0dad8588fc3eff4c38993728e

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      f54daae1a8b9ecbd38de8d2aef21cc39

                                                                                      SHA1

                                                                                      e288240789f592a344887fadd00f41c727530db5

                                                                                      SHA256

                                                                                      68a03c20cb9297c8f58314103e1efeb12443ba4a0825e04a8edf66ceb8496fac

                                                                                      SHA512

                                                                                      032ff182a290fc83b3d82413291b81fd1a928f1fcd533ae5734f2ae863c1c616f71d3152cba7e3dcaeb9741b590f91511bb284d325505944c13a5b2044d493ef

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      5KB

                                                                                      MD5

                                                                                      a7f210890c3a79a334cabda020516d4c

                                                                                      SHA1

                                                                                      6ae6d270ffa7b9716baf20da08ab17df7f150c45

                                                                                      SHA256

                                                                                      af9290cc62acf25fce91f59a53110161e4202c89199e9fbf0cb4509dd9187171

                                                                                      SHA512

                                                                                      1fa942d3585b4781e79943473f38be0b8a4a1b5ab0ea2d6ad0db535a22c5cdf7962d49aaaa6c424c52ec41c4efc4ed8075e0e08504fd29c672ba1803fc1e8fd8

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      90240feb922ff7764018cc15811f2db9

                                                                                      SHA1

                                                                                      46589be70098ee674ba52f1865bd2fd4193ddcbc

                                                                                      SHA256

                                                                                      a9868476248e2ecc510d4a938514e4b0e161ae8b447546849535f3f9e8e3348c

                                                                                      SHA512

                                                                                      7bd14d609b39653602f43c5cc0a77ef39ee9d1c7b67e15d7f2f534d6a7c78f2d697cd35bb3eea80e65def9f6ed135ba43c065301d0e2689262ed1cc0b143021d

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      35787fb2e1b8d28e1c0917c05748d87b

                                                                                      SHA1

                                                                                      7b80123f8cea44a8980b6b2ef76803d8cdb9c3b5

                                                                                      SHA256

                                                                                      1f9c687c5327af504bc59496f6ca804c9a5d67aa2a9366d95e60c0b1e6afc494

                                                                                      SHA512

                                                                                      b9f274dc2e11705f04c54bf4c5ca99a9edccabf221ad1a4384b0a65f540c7dfdb8ced18d4ddda5ccbeb137201cf21dc830eb85f0a9ea37d562dad48d9d5854b7

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      d8a37d38ec30220c75f894a8e627cd44

                                                                                      SHA1

                                                                                      48468b58b7c661cec44f5dd41811eefba591deb0

                                                                                      SHA256

                                                                                      bd7a3eaad7f4d78f038918b40d93f80f84d6970445517af608eb4bbb774f1943

                                                                                      SHA512

                                                                                      8d24ebbb55fef591da6c19140d57631e43f33ec8d787c5e8f2ec71ba509b878c475fd3548e3b8974bdcb4ec2803a8601cc3757b0f41bf17994a0c9495395617c

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      fa538f64048da3ee31db29261006b434

                                                                                      SHA1

                                                                                      07a9d5b8b3f095afdd7eb986f8e8bc369adf33c1

                                                                                      SHA256

                                                                                      cbfd4996c0d96d80658dddfc30e2d25655ebeea4a80f0dcdd097a4d21acd0f16

                                                                                      SHA512

                                                                                      265bee36ca78cc6e2a7e2d0f437c82b6d50c450ad85c64b3ed25a8c84e6d95d0900d856e86ff18bacbe3f172254633fa7d4041e7ea9555ccb38e23092505159f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      2d1acf085ff1663c3516178e3647eba8

                                                                                      SHA1

                                                                                      bc73d6b3f1236611493a8d96205ac2e034965e89

                                                                                      SHA256

                                                                                      da3f8a7bfa5c7e3f22928a5203c4fa3324a0a0414356f8dab4c211434ddad77b

                                                                                      SHA512

                                                                                      9d4b72f25a28b3a71104033fb1e28d355164caff465105d95ab7effc8af9a7b1c968a89135542c099fe8d7f674a0ce4e43aba6280d794a026c429e676041c2c2

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      9ba81491605a84176c1d3287143133ef

                                                                                      SHA1

                                                                                      9331684f10bbec2362b0c1ec19ee43adcbe7d66d

                                                                                      SHA256

                                                                                      96d952c2f8e979690dd7c6305bfa73911657fa9d8fe948a9fe5864c696df0e46

                                                                                      SHA512

                                                                                      d07753029d17ee8722f6b984ea728386741d3af04c8d7eb852f5c035f35366739bae556e4ba751dc6fd6ddbb2317fb20e174b7b66e8b8f2235fef455ff3bff02

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      65e1ea4833856a8aeaf8c361b5aec029

                                                                                      SHA1

                                                                                      baae501695d5982258b07d6780ae854f9fc0d00b

                                                                                      SHA256

                                                                                      11ddfa55ecc3ec909f5ed4062201f68933a2f3a21ab8cd1d4328d78bd4459b4d

                                                                                      SHA512

                                                                                      6498da7f3c676f1ea1b6f0fa483383f311e12557ffdc713d32084d0761d896d27a72a27b4775c244ba5f33cf6ef373f92185716fd04989f07186019624af62cb

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      1648d5e545f01bb073963b01e5bc0de3

                                                                                      SHA1

                                                                                      47eb42b34e1bb45e853a89ab890490261d2337f9

                                                                                      SHA256

                                                                                      69621e1fba2d5ba1fb4343eb7a32aed6d6b5872db2971e631198a1b7e9d03bd7

                                                                                      SHA512

                                                                                      1993bc06ce3b27e31f054371d82d2f015b1ba3c0897db2f72ef402909b5bca789d81104200224174e53cf50f6d61d12f5aa04766b89f1383d4aa4fc5a2445b1a

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      89955842c38401c815550c5c3e9663fa

                                                                                      SHA1

                                                                                      871a2d3daf8751cbbd85f5747354698339dea277

                                                                                      SHA256

                                                                                      a20400bc4f9ced4237a449bf3ba204277a7de26bab9ddec5356afbdc3e77f0c1

                                                                                      SHA512

                                                                                      8c6cfd1cedfbe4bdb94dc553e48260e48e8e50fd7d532b8eb6e61f2684ac3e4cbd3eb0c398612f2a9ddb01d0ca2a518360a5ff43d526c49b517b51ad73728fad

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      58cb7e156a43dddc49ecbaa049a9231d

                                                                                      SHA1

                                                                                      b0ad0fb35645cf2f42910658768a812e08aba3cf

                                                                                      SHA256

                                                                                      8b170d4a239847460e90e434cdc0e6bb3359db34c43743647ead6d4a8230f973

                                                                                      SHA512

                                                                                      5cd508404b59ae777c8e62e86c5e1b14cfabe66cd51e9a7a29aa44fdb797a9070dc8be94daa7844597059f25d0026589ebf748f646efeb093c0e2171a9786481

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      c3e0de47b95b6ca41cfc24acc99fb391

                                                                                      SHA1

                                                                                      9f8a79d040fbf4dd9a70e3239ccb6d3012cde540

                                                                                      SHA256

                                                                                      65f8b4bb8e3ff2d03f6605378ae8dff97d267926525f113df887a7b9de4d8ea6

                                                                                      SHA512

                                                                                      449f80440a907ed02c458a990f3219fe6390a7df306dc5c3be4cf09b754370bc61845a6fa07df49242d5aff1960e258e00fc53a841788965c5d70451af12636c

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      eeaba2e622dc161cd5b74f3f6779213b

                                                                                      SHA1

                                                                                      1bea87ee9803c244e520b8c33ea9c411fe0f9307

                                                                                      SHA256

                                                                                      b64c57a5e4211b80903b5223f5242f5e03f4337c0d4f4025316a89e4a7f1d2b0

                                                                                      SHA512

                                                                                      edd23ffd50d609aa8ae4133348fdc56d0e90599e5a1ac3563e7840c0cd32bcf3ccebb46597007445d62b7eaccddd4c13b4195979e7978f1797c1a9054796d5d0

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      743ff4b6adf61fcd7d953961b73fa996

                                                                                      SHA1

                                                                                      9a14d7db803476e8f7728a9ad5b855e686510132

                                                                                      SHA256

                                                                                      5944bd3dd14fb96e93eec490edab7aa4ce3503af8bbe6ad24e9a79202e82b22d

                                                                                      SHA512

                                                                                      af8b26839d927f8d0eb13c299a866ad3004842778da5cf0a77df99769b0fb889017b472ecf27ddfc3d553359976c45bc875826f3ec4f69b99d2ea2de7084ec1b

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      afce7332777b2b5f25b867e734851a07

                                                                                      SHA1

                                                                                      26c28212c92f10b6f6673fe04a46ec58039cdbda

                                                                                      SHA256

                                                                                      c40d014286ea19e26502d50804ff972674b8feab77ec0281744eb5517a614506

                                                                                      SHA512

                                                                                      dffbfe7e6054203a653918c4e99d9df9c8bc847ab6c5bff1dfb4662144821d406aedf50f008e86eafc086e5ef2a76e95078bad9d5d81bbe83bd43aaffa17e708

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      c95643c8e5b00a233b11b6f56f1327db

                                                                                      SHA1

                                                                                      e43ed7b72e08ddcdc6de45798932bdbc8264eb90

                                                                                      SHA256

                                                                                      4cae1732678e4c806a9face42e98976cb51559739895d14a9fc8e5c15feb1d7f

                                                                                      SHA512

                                                                                      516c9adf56dc6ea0de7707ee988e046365a5666dd52ccb17b408f0e48c26b262ce58d7f349437b0b0790ca66be6a5d4788bda421a4b8090faf44ad42044a47dd

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      7fdcfad2d84ba5ce62d7a9c838503ace

                                                                                      SHA1

                                                                                      07e4eb7fce773179ba6ea9fe1e1ec879ac6e8fe4

                                                                                      SHA256

                                                                                      f55ac2ff160363c9dc67535c3bcb7bd533050949039355cf0131ab2f5835f312

                                                                                      SHA512

                                                                                      865dc0b92899bb7c1b3a62dbad89bd4ab59c05eec30dc06b40829e1dd52d3075c8e69472a5ffec8cd69aacdb9223da91fd1ef7b996d24af9a0bd2f9b6ff16f78

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b63.TMP

                                                                                      Filesize

                                                                                      538B

                                                                                      MD5

                                                                                      ba020847c2ee60f000334e775d6ba8d3

                                                                                      SHA1

                                                                                      e2007364b3ee658846c09bfb400a582ed721fda9

                                                                                      SHA256

                                                                                      f2a8e46e6d5f5aa6cc74120abb8bc947eb7e7c893b8d129cc520f971671ea964

                                                                                      SHA512

                                                                                      3e3576a136b56f54cf4000853c8a867e2cdbf0838040c58febceab9861dd78d0bd0bf4215962b231ff14ec6e531cf2d7be3e1df035edbce70b8edee28f4b0a94

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                      Filesize

                                                                                      16B

                                                                                      MD5

                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                      SHA1

                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                      SHA256

                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                      SHA512

                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      ed2adb9b4bb98a982745427ca50ef476

                                                                                      SHA1

                                                                                      a598abae7efe3b4c674f4be987143ad67fdc1a97

                                                                                      SHA256

                                                                                      69dfc475854f18dcf0ec76f72584c11c7c90686ce6b70073945a2596007ed70b

                                                                                      SHA512

                                                                                      020b4d60be1dd920f356b31d81e12980bdc220b57e133118fc9e6224f5fc326b6f850f43620ce9c7a37006d806bc9e3de46802f5208c4328f65149f77b2a6650

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      8fc71c30d21628581ed53c8a0d9d37f1

                                                                                      SHA1

                                                                                      cefa13a8310d4968f40ae7b9f2c6bf87db8a20db

                                                                                      SHA256

                                                                                      e9d494ec7ba79eccf66f9c55905909e62ecaabf1adcbf1e5a56951f64191f897

                                                                                      SHA512

                                                                                      023a70e0fac5b9e40184bdb02cb62abde561c71315ba0e655372d26230604bcd1932d75c0c79654cf55934e557525ed7d00f4219eae7f330f69bc856e6fafb26

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      32339b3dee519913251d804a94fddf36

                                                                                      SHA1

                                                                                      b4a8943400b4aafe13fce020fe1af69883f0e60d

                                                                                      SHA256

                                                                                      6ba50a0d38191f49c93106c3f669fcaa8b8b1176e490d159e11879fa9fad464e

                                                                                      SHA512

                                                                                      6b16b3351867dddac8ac5efbbc92d5a67b4999ab7fc06e13bada393676da775c141cead9ccc7cded7f1b736f1fa94a6bc841c03b63dc9824433d72328ea4a5cc

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      10KB

                                                                                      MD5

                                                                                      cc3d98e9b1deb6cdadac5870aa97c49e

                                                                                      SHA1

                                                                                      dac57460554a04975e6eba434d0d298e4b43cfa1

                                                                                      SHA256

                                                                                      e574acc5054219db5448825d968c2ee86823a2860cfdc4df9fb5612baeb132b4

                                                                                      SHA512

                                                                                      581ece9fc5f03bd016c2eeb74bb9bf8a15d188ae2f130d3f48265647c4244561028a65479418a44907efe3622b5283c26fbce70b3a932e8f72abf34240d676fd

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      fbcc79dce015d17196e0200fb8831bdc

                                                                                      SHA1

                                                                                      894921d98fee27b60b256ce485ce3020d0022b2c

                                                                                      SHA256

                                                                                      285d7cd1b760fd0c613509550736b123c8f78fa4b39854a8a30e592b2cec59de

                                                                                      SHA512

                                                                                      9371c4815bd313bf4b6f14b6a1882db61bc5597d0bf349d38018e85b9c8175ea5f02a80d478300a350df3ebc2c06313a9808fabe2507b551c51279d2c005e8d8

                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

                                                                                      Filesize

                                                                                      46B

                                                                                      MD5

                                                                                      d898504a722bff1524134c6ab6a5eaa5

                                                                                      SHA1

                                                                                      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

                                                                                      SHA256

                                                                                      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

                                                                                      SHA512

                                                                                      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

                                                                                      Filesize

                                                                                      46B

                                                                                      MD5

                                                                                      c07225d4e7d01d31042965f048728a0a

                                                                                      SHA1

                                                                                      69d70b340fd9f44c89adb9a2278df84faa9906b7

                                                                                      SHA256

                                                                                      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

                                                                                      SHA512

                                                                                      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

                                                                                    • C:\Users\Admin\AppData\Roaming\US8B0-24XET-XTRTX-HTFTO.HTML

                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      f17dbc0257703ecea9d0e774cfcaf464

                                                                                      SHA1

                                                                                      2c583ec6f9e512c8691ab05f8c6c787667cf6675

                                                                                      SHA256

                                                                                      4a5b1d9461723296f22c53854934df6d76a38eac165b1878070f4303663b2860

                                                                                      SHA512

                                                                                      99d2cea1bf5548c2bd773f6cf2386feed9c17370fb0977cdc69b65812e3ab8ca8babbc37bdb01608fe253db159873b34313d39d394783af68235b06063e677ff

                                                                                    • C:\Users\Admin\AppData\Roaming\US8B0-24XET-XTRTX-HTFTO.KEY

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      bc49276c77fcea0b3c2f5de7f1b39641

                                                                                      SHA1

                                                                                      ce9466394615832e2cd73f6499c2ed2bb39ca664

                                                                                      SHA256

                                                                                      66f0e7cf273156342c5f255f96e1499960c3a1ab594c412161c4b4a722b18b53

                                                                                      SHA512

                                                                                      a7f678cf715b7e1d6b0a8047ecc3b287e4d8723e24a74849f4212a50ee96bebb0b7c1f4d30a14ee7e91c113960036e107d5f064bd3f77c801aab176e70e8229f

                                                                                    • C:\Users\Admin\AppData\Roaming\US8B0-24XET-XTRTX-HTFTO.LST

                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      ad6d8de1cbe6f0f159257de7fb319b7a

                                                                                      SHA1

                                                                                      b05e2026f11b6cd848014b805efd60e10dce3098

                                                                                      SHA256

                                                                                      8c38c1c55f8e9f3492888883f8d90db854014c2a37366822b3175bfb4139655e

                                                                                      SHA512

                                                                                      365ad7dfaf88134b1887adf0daa08635214c48d79c0f85ead1ca1046258a1223848458761ba92dc8ef6531a90bfb239c7d34d8194f969d22e27f2c458fd99d08

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 114898.crdownload

                                                                                      Filesize

                                                                                      300KB

                                                                                      MD5

                                                                                      f52fbb02ac0666cae74fc389b1844e98

                                                                                      SHA1

                                                                                      f7721d590770e2076e64f148a4ba1241404996b8

                                                                                      SHA256

                                                                                      a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

                                                                                      SHA512

                                                                                      78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 269680.crdownload

                                                                                      Filesize

                                                                                      43KB

                                                                                      MD5

                                                                                      b2eca909a91e1946457a0b36eaf90930

                                                                                      SHA1

                                                                                      3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

                                                                                      SHA256

                                                                                      0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

                                                                                      SHA512

                                                                                      607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 364762.crdownload

                                                                                      Filesize

                                                                                      84KB

                                                                                      MD5

                                                                                      b6e148ee1a2a3b460dd2a0adbf1dd39c

                                                                                      SHA1

                                                                                      ec0efbe8fd2fa5300164e9e4eded0d40da549c60

                                                                                      SHA256

                                                                                      dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

                                                                                      SHA512

                                                                                      4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 364762.crdownload:SmartScreen

                                                                                      Filesize

                                                                                      7B

                                                                                      MD5

                                                                                      4047530ecbc0170039e76fe1657bdb01

                                                                                      SHA1

                                                                                      32db7d5e662ebccdd1d71de285f907e3a1c68ac5

                                                                                      SHA256

                                                                                      82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

                                                                                      SHA512

                                                                                      8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 570008.crdownload

                                                                                      Filesize

                                                                                      246KB

                                                                                      MD5

                                                                                      9254ca1da9ff8ad492ca5fa06ca181c6

                                                                                      SHA1

                                                                                      70fa62e6232eae52467d29cf1c1dacb8a7aeab90

                                                                                      SHA256

                                                                                      30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6

                                                                                      SHA512

                                                                                      a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 744376.crdownload

                                                                                      Filesize

                                                                                      24KB

                                                                                      MD5

                                                                                      4a4a6d26e6c8a7df0779b00a42240e7b

                                                                                      SHA1

                                                                                      8072bada086040e07fa46ce8c12bf7c453c0e286

                                                                                      SHA256

                                                                                      7ad9ed23a91643b517e82ad5740d24eca16bcae21cfe1c0da78ee80e0d1d3f02

                                                                                      SHA512

                                                                                      c7a7b15d8dbf8e8f8346a4dab083bb03565050281683820319906da4d23b97b39e88f841b30fc8bd690c179a8a54870238506ca60c0f533d34ac11850cdc1a95

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 99562.crdownload

                                                                                      Filesize

                                                                                      225KB

                                                                                      MD5

                                                                                      af2379cc4d607a45ac44d62135fb7015

                                                                                      SHA1

                                                                                      39b6d40906c7f7f080e6befa93324dddadcbd9fa

                                                                                      SHA256

                                                                                      26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

                                                                                      SHA512

                                                                                      69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

                                                                                    • \??\pipe\LOCAL\crashpad_2232_IXSIIRQRZEMDGNAM

                                                                                      MD5

                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                      SHA1

                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                      SHA256

                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                      SHA512

                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                    • memory/696-1169-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/696-1015-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/1496-1212-0x0000000002A50000-0x0000000002A64000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/1568-1385-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                                                      Filesize

                                                                                      648KB

                                                                                    • memory/1568-1382-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                                                      Filesize

                                                                                      648KB

                                                                                    • memory/2152-1296-0x000001BAFED60000-0x000001BAFED7E000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                    • memory/2464-953-0x0000000000D00000-0x0000000000D10000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/2464-954-0x0000000005AA0000-0x0000000006044000-memory.dmp

                                                                                      Filesize

                                                                                      5.6MB

                                                                                    • memory/2464-955-0x00000000055A0000-0x0000000005632000-memory.dmp

                                                                                      Filesize

                                                                                      584KB

                                                                                    • memory/2464-956-0x0000000005670000-0x000000000567A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/2528-1175-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/2528-1051-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/3804-1194-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/3804-1054-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/3832-1174-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/3832-1050-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/4884-1206-0x0000000000F10000-0x0000000000F62000-memory.dmp

                                                                                      Filesize

                                                                                      328KB

                                                                                    • memory/4884-1224-0x0000000006820000-0x0000000006864000-memory.dmp

                                                                                      Filesize

                                                                                      272KB

                                                                                    • memory/4884-1223-0x00000000066A0000-0x00000000066A8000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/4884-1258-0x00000000066E0000-0x0000000006702000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/4884-1222-0x0000000005E10000-0x0000000005E18000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/4884-1207-0x00000000032B0000-0x00000000032C4000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/4896-1168-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/4896-1014-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                    • memory/4940-1332-0x000001FA43070000-0x000001FA43984000-memory.dmp

                                                                                      Filesize

                                                                                      9.1MB

                                                                                    • memory/4944-1397-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1386-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1387-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1392-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1393-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1394-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1395-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1396-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1398-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4944-1388-0x00000200FE930000-0x00000200FE931000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/5952-1465-0x0000000000400000-0x0000000000407200-memory.dmp

                                                                                      Filesize

                                                                                      28KB

                                                                                    • memory/5952-1631-0x0000000000400000-0x0000000000407200-memory.dmp

                                                                                      Filesize

                                                                                      28KB