Resubmissions

10/11/2024, 23:08

241110-241g4swpg13

03/10/2024, 23:01

241003-2z1bjs1fpm5

Analysis

  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/10/2024, 23:01

General

  • Target
    https://staemcomnnunity.com/gift/activation/id=5947221648
  • Sample241003-2z1bjs1fpm

Malware Config

Signatures

  • Detected potential entity reuse from brand STEAM.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://staemcomnnunity.com/gift/activation/id=5947221648
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa049c3cb8,0x7ffa049c3cc8,0x7ffa049c3cd8
      2⤵
        PID:4016
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:2
        2⤵
          PID:3896
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2760
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
          2⤵
            PID:1688
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
            2⤵
              PID:4752
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
              2⤵
                PID:3404
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                2⤵
                  PID:3592
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2768
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
                  2⤵
                    PID:4628
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
                    2⤵
                      PID:2912
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1220
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
                      2⤵
                        PID:4176
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
                        2⤵
                          PID:4632
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                          2⤵
                            PID:1136
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
                            2⤵
                              PID:1484
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
                              2⤵
                                PID:1292
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2632 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1836
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5916 /prefetch:8
                                2⤵
                                  PID:784
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1728,9792193072337624096,6470063948880042658,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3496 /prefetch:8
                                  2⤵
                                    PID:800
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3144
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:8
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004E4
                                      1⤵
                                        PID:3052

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            77EC63BDA74BD0D0E0426DC8F8008506

                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                            • Size 328B
                                            • SHA256 c3ddcd0a75d25da4d5e544bfb2df9b05709eb1e5d606bf3b901bcd3a1d1a5bd7
                                            • MD5 SHA1 SHA512

                                            settings.dat

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 152B
                                            • SHA256 0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4
                                            • MD5 SHA1 SHA512

                                            settings.dat

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 152B
                                            • SHA256 f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02
                                            • MD5 SHA1 SHA512

                                            2414d220-dace-4014-8e5f-4f9f03999725.tmp

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2414d220-dace-4014-8e5f-4f9f03999725.tmp
                                            • Size 1KB
                                            • SHA256 5b442399874afd2aa2a379b30b8c911c5a4ac44645be3ba517b82b2871f64725
                                            • MD5 SHA1 SHA512

                                            f_00001b

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
                                            • Size 18KB
                                            • SHA256 52a09aedb67d370ca5bf8805bf99cc646fd0c29ce5b46b0534c476f80c1af7dd
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000026

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026
                                            • Size 40KB
                                            • SHA256 768edab1ea3c4580ffcd3931eb6b3776961a73094a20c00fb2299382a53e8ef2
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000027

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027
                                            • Size 53KB
                                            • SHA256 f9e93ca58dc2a7533a443930958db5122b834074285ef33ce51fd775b7fb493b
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000028

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028
                                            • Size 61KB
                                            • SHA256 9bfbb85d238d9b05871f581927698f499146ba14a16e92bcdb24d72bd72f1dcf
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000054

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054
                                            • Size 25KB
                                            • SHA256 15321a16e6081ea8a8f7cb3bdf418a37a852a985737c43d3cccfda0fd61c3e52
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000057

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000057
                                            • Size 36KB
                                            • SHA256 ff066f3e1ab3028b7bf326825772da1a50d4c9bfe92ec0abcb52f17ed996482c
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000059

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059
                                            • Size 20KB
                                            • SHA256 d90bde2cee49d26d93cc149da64ebfe3b57b6f391c1fe84c696a2d5e3f33b3ad
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_00005e

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e
                                            • Size 121KB
                                            • SHA256 045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_00005f

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f
                                            • Size 119KB
                                            • SHA256 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000061

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061
                                            • Size 17KB
                                            • SHA256 a874713e3e0eb8493a6e41b0b78eade498ee3f50325076920c9fbd1c6b015ab9
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000062

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062
                                            • Size 53KB
                                            • SHA256 36ca1abce5952f005098800c8fb93effcfda710a47ca6d288cc4a82b0de9d306
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000063

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063
                                            • Size 40KB
                                            • SHA256 167b5e3d2fc6a069ef986144f71f70ca1ed8c4332846757c8aa4792703420635
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000064

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064
                                            • Size 120KB
                                            • SHA256 d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000066

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066
                                            • Size 37KB
                                            • SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_000067

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067
                                            • Size 31KB
                                            • SHA256 9a74207bb1256b3215dc6b1e3fe01ceb05afa084b0eb87004f986f686fd2bd69
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_00007d

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d
                                            • Size 131KB
                                            • SHA256 fc76b07c4a37f312ff1883efefc994e48bfc407942abbe823d665d46c2a883d2
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f_0000a7

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a7
                                            • Size 121KB
                                            • SHA256 9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954
                                            • MD5 SHA1 SHA512 SSDEEP

                                            0be1269de99da105_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0be1269de99da105_0
                                            • Size 23KB
                                            • SHA256 0ea4bcaed527b932e1b2063cda7af797ce4ef04dada464834cdc7a23bad09660
                                            • MD5 SHA1 SHA512 SSDEEP

                                            0d12de3d313a6601_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0d12de3d313a6601_0
                                            • Size 340B
                                            • SHA256 754797c82421245882ec2ca3aca9188aeda276a66dd894d2e27ff0a56516af71
                                            • MD5 SHA1 SHA512

                                            37156bd7ba1ccd5f_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37156bd7ba1ccd5f_0
                                            • Size 9KB
                                            • SHA256 eeea8978897b50af12bc4d781091ffff856261f4fa4572dc435bb795343a8af0
                                            • MD5 SHA1 SHA512 SSDEEP

                                            4aea2d780958e15b_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4aea2d780958e15b_0
                                            • Size 24KB
                                            • SHA256 77e66c780dfa7583e51897d2c2ba1d5d2b70f31d41362a50f85ec4d78c3ae1b7
                                            • MD5 SHA1 SHA512 SSDEEP

                                            4af1e96e657b146b_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4af1e96e657b146b_0
                                            • Size 339B
                                            • SHA256 093ed0b022266aff6bf582aa0f096374d06eec1b0b526915c970ad4440bb32c5
                                            • MD5 SHA1 SHA512

                                            4fe35a1b58b340d0_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4fe35a1b58b340d0_0
                                            • Size 415KB
                                            • SHA256 f2b85f60a1e79cc489d77958b2d5c0e9d4d46f88fc74f8a84c80df75d9897f33
                                            • MD5 SHA1 SHA512 SSDEEP

                                            6e630d8aecf69020_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e630d8aecf69020_0
                                            • Size 340B
                                            • SHA256 f3ae8321f99634c22c70d5db6427b176d425cc1cd85517c925fed4ff975defcd
                                            • MD5 SHA1 SHA512

                                            7a08c9cd6208251b_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a08c9cd6208251b_0
                                            • Size 65KB
                                            • SHA256 1f24408bb9f29eeaaeaccd340d1fc3cbb835763ddc2f762aa31a757b29312a9e
                                            • MD5 SHA1 SHA512 SSDEEP

                                            85d6d9ccf6fc1a7c_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\85d6d9ccf6fc1a7c_0
                                            • Size 5KB
                                            • SHA256 e00943a7133a2c48ca042e38123343fffb1f9d02a59f9243e7d49055d397d18b
                                            • MD5 SHA1 SHA512 SSDEEP

                                            b256f67031a8eb85_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b256f67031a8eb85_0
                                            • Size 333KB
                                            • SHA256 cb56391f65ce74a66cd25083e48941c978e27ae2a2a761b5fb41f402ca1437ad
                                            • MD5 SHA1 SHA512 SSDEEP

                                            c99acd98044d3a9e_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c99acd98044d3a9e_0
                                            • Size 29KB
                                            • SHA256 6977ed7c8f2f2e766f3130daf92af18f250c22736152dc6db022e9dca576d730
                                            • MD5 SHA1 SHA512 SSDEEP

                                            d00cbc83c2b3a2db_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d00cbc83c2b3a2db_0
                                            • Size 17KB
                                            • SHA256 899e2f3ea2835f40aa6ed2f5d177079aa9a14dd8ac1025b3e086e2cdc01c949a
                                            • MD5 SHA1 SHA512 SSDEEP

                                            eeaaf6d6c9ba4f21_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eeaaf6d6c9ba4f21_0
                                            • Size 128KB
                                            • SHA256 ef72a40a03291c6338682d9b0f7bac74753df04e782c586600fff63c1aa765de
                                            • MD5 SHA1 SHA512 SSDEEP

                                            f8ea218751ee6ca2_0

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f8ea218751ee6ca2_0
                                            • Size 338B
                                            • SHA256 16738642fbf6cbfbb5f54c30a33ad8e2fba73079fe98e320d0c07776b6823574
                                            • MD5 SHA1 SHA512

                                            the-real-index

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            • Size 2KB
                                            • SHA256 59e349ebb58375aca3e44499889e64061677a6edd8d83ff4a23cc980ad5ccb52
                                            • MD5 SHA1 SHA512

                                            the-real-index

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            • Size 528B
                                            • SHA256 18fe2ea03440eae8c619d162eae3eac21d22f13baab1f8528d295098967c6404
                                            • MD5 SHA1 SHA512

                                            the-real-index

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            • Size 1KB
                                            • SHA256 69ecb7c71229c9a5a71a3ac137808b132d56a92574cd5b8e29054cdf6b83b8d0
                                            • MD5 SHA1 SHA512

                                            the-real-index

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            • Size 2KB
                                            • SHA256 6e5811291bf23e28ee75cea6efb869236a1150baf3d329894013f1f3d9aa5039
                                            • MD5 SHA1 SHA512

                                            Network Persistent State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                            • Size 1KB
                                            • SHA256 ea89e624365393aa51feb5fb30d9ab4a816cd3f7baf49795945dbbe6f08f757e
                                            • MD5 SHA1 SHA512

                                            Network Persistent State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                            • Size 1KB
                                            • SHA256 917b94f5ba7f5333a16383f2e7c4d5fe0a4b89c9cce1f0f30c414e33ee059567
                                            • MD5 SHA1 SHA512

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 5KB
                                            • SHA256 653cc25debd19c1edf1bf32749dddf218a587bf407bdbf8ae6a2cc21c3a1cd3f
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 6KB
                                            • SHA256 e85b28fe41c9453eb56da58e61b306bf9d4f2a9f25dd95bdc6c90cd49b5599db
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 6KB
                                            • SHA256 410ea2b7c379a52a81cc5f9e013cff9f1e9d0eccdf4d0ae73993eb17d9508711
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 6KB
                                            • SHA256 c16cbf160f6531c513ee2c43f5fdaf58ab3dd4ad36754024b75a2d3085720b12
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 6KB
                                            • SHA256 e3e3738133c6effd3e3a67c586087c6767fd070fbf3e874291a57c9c52ed892d
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 6KB
                                            • SHA256 77c67cc6689e2f8e2863335db671cfda7d0663406ae34ee404e912e243774d02
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 7KB
                                            • SHA256 d1b2c03a502d11b8293610dce15075f2557ec60ae63cc18bbe964125d1846cec
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 7KB
                                            • SHA256 8ced82946ba67677d07dbf2c8a479f6528eec7c8d0ae737748dff87ec3bb6107
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 7KB
                                            • SHA256 83133990531457bbff32b1521b9b3a6c562e6654c4e5bfd23f02e2523eb70011
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 7KB
                                            • SHA256 7e753ad4cafd8f3a20f57820c67838f9a04eed63b7dc2d7836444e9afb523af3
                                            • MD5 SHA1 SHA512 SSDEEP

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 ca29618b92e00b18d8e04e88691f6710bf587a9440bf6744718b7df437aca448
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 4f9045299c9435b612044d9f3a6fb4e1e7c82fa5a148a6c7981cc6dcbb9a04cc
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 742c85cf389857b99a323fd81e3b98ee4326d8a32b921803e1fe96fe4b61ddcc
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 874B
                                            • SHA256 a8c88c6268fc15218787370ccc6ca1f6b4a36e5e63bd8c0b380de9dc2e1e0a36
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 74144113efe454dc23666b133766cd8e6838581aeec220c9bb029b3708e8f7f2
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 92ee18095a9882498f416a2ee7aab4c97675052ad0a54acbc608e37625d55b9b
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 81290345bab853bce88688b71b2afd49c477b8a729086a97d764713d88cdbd35
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 447fcc7bba1ced3d619ac7e45eff7c31b169506c05e879310b2662b16bc7f2b0
                                            • MD5 SHA1 SHA512

                                            TransportSecurity

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 3e6714e30927e819ef1ce2d7d9426b543db29baf579fb82ee7da71c15a8554f2
                                            • MD5 SHA1 SHA512

                                            TransportSecurity~RFe580162.TMP

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580162.TMP
                                            • Size 707B
                                            • SHA256 f2c5030a6346a13ec5af050475efd156d11d230872edb51a03a8fcf15fe2c9f0
                                            • MD5 SHA1 SHA512

                                            CURRENT

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                            • Size 16B
                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                            • MD5 SHA1 SHA512

                                            CURRENT

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                            • Size 16B
                                            • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                            • MD5 SHA1 SHA512

                                            Local State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 10KB
                                            • SHA256 89cb554297f3043480f56798d72ab96aa8d430ec2006e896b2a22b27aa0a7d64
                                            • MD5 SHA1 SHA512 SSDEEP

                                            Local State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 10KB
                                            • SHA256 62440fe0dae6f7306914638fc5d512c126728e35980c53f2647423d1872e488c
                                            • MD5 SHA1 SHA512 SSDEEP

                                            default.dic

                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                            • Size 2B
                                            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                            • MD5 SHA1 SHA512