nanocore | b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Size

615KB
MD5

b730a4aa8f3e25e676345de5315a38a0
SHA1

016d23066ad4f0de135374dbce36d5cab88dc27c
SHA256

b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7
SHA512

2335d900ff41b421b27c7f0f83d96df9e28465cc37171ab70823ce41d0fd425342dbb41f1aef555f2be8307ea0bca917de04708c321ced71e2178ca92b18b555
SSDEEP

12288:dYV6MorX7qzuC3QHO9FQgd5sCbjwejD3Gf4UD1ICyHz0su:yBXu9HGaCwPdTQ0su

Score

10^/10

nanocore discovery keylogger spyware stealer trojan upx

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

obinnaucenna.ddns.net:2020

127.0.0.1:2020

Mutex

925cbfe1-d6b9-4a04-a147-c3b400f19292

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-02-13T23:12:54.962685636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2020
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
925cbfe1-d6b9-4a04-a147-c3b400f19292
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
obinnaucenna.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2940-29-0x00000000003D0000-0x000000000052F000-memory.dmp	autoit_exe
behavioral2/memory/2940-54-0x00000000003D0000-0x000000000052F000-memory.dmp	autoit_exe
behavioral2/memory/2940-136-0x00000000003D0000-0x000000000052F000-memory.dmp	autoit_exe
behavioral2/memory/2940-241-0x00000000003D0000-0x000000000052F000-memory.dmp	autoit_exe
behavioral2/memory/2940-345-0x00000000003D0000-0x000000000052F000-memory.dmp	autoit_exe
behavioral2/memory/2940-478-0x00000000003D0000-0x000000000052F000-memory.dmp	autoit_exe
behavioral2/memory/2940-582-0x00000000003D0000-0x000000000052F000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 2136	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	84
PID 2940 set thread context of 2632	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	121
PID 2940 set thread context of 5976	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	134
PID 2940 set thread context of 5880	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	144
PID 2940 set thread context of 5704	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	154
PID 2940 set thread context of 5068	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	162
PID 2940 set thread context of 5716	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	180

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2940-0-0x00000000003D0000-0x000000000052F000-memory.dmp	upx
behavioral2/memory/2940-29-0x00000000003D0000-0x000000000052F000-memory.dmp	upx
behavioral2/memory/2940-54-0x00000000003D0000-0x000000000052F000-memory.dmp	upx
behavioral2/memory/2940-136-0x00000000003D0000-0x000000000052F000-memory.dmp	upx
behavioral2/memory/2940-241-0x00000000003D0000-0x000000000052F000-memory.dmp	upx
behavioral2/memory/2940-345-0x00000000003D0000-0x000000000052F000-memory.dmp	upx
behavioral2/memory/2940-478-0x00000000003D0000-0x000000000052F000-memory.dmp	upx
behavioral2/memory/2940-582-0x00000000003D0000-0x000000000052F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2136	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	84
PID 2940 wrote to memory of 2136	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	84
PID 2940 wrote to memory of 2136	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	84
PID 2940 wrote to memory of 2136	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	84
PID 2940 wrote to memory of 2136	2940	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	84
PID 2136 wrote to memory of 1904	2136	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	93
PID 2136 wrote to memory of 1904	2136	b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe	93
PID 1904 wrote to memory of 2424	1904	msedge.exe	94
PID 1904 wrote to memory of 2424	1904	msedge.exe	94
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 3676	1904	msedge.exe	97
PID 1904 wrote to memory of 1932	1904	msedge.exe	98
PID 1904 wrote to memory of 1932	1904	msedge.exe	98
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99
PID 1904 wrote to memory of 4512	1904	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
"C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
  "C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:1
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2821156983075043340,13207355698746096708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
      4⤵
      PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:3108
- C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
  "C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:5900
- C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
  "C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:1708
- C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
  "C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:5280
- C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
  "C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:5252
- C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
  "C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:4348
- C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe
  "C:\Users\Admin\AppData\Local\Temp\b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b65ac61b407ad6e48ccbee885e0d0e5b135eecc39bc2b4c68ad578925e3ce3a7N.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffca12746f8,0x7ffca1274708,0x7ffca1274718
      4⤵
      PID:5832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
45KB

MD5
5c76c807cf3455881a477f87a1f2aa07

SHA1
70970c838cc08b557b7c7feec161c93b1d772cb1

SHA256
84af7b45c3330e2e810d0aac6bf37c78358785e89dfb5bfb2032b018bfb9994f

SHA512
31c39309307c82cefb0d328f086888980d59262bbe2f0ac0c2c5af1524808b5672c9a1ad74f3ffe545850face3b4692c89fce1acc4253ec2ec379a22d8e29816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
67KB

MD5
f32d62fd2a6586381f57494b37fa4fb2

SHA1
da0f954e9b7f8baca98fa7c4d579632f76cf9e07

SHA256
68ee987b697856aef8b7d8136eab3d3a875d6a7f5cd3971668df1c719cce1e31

SHA512
48f5fd39dc957abb24c49d9189aa42d960218fa60a02c3f34fa15479f5b0dc06313a1c4eb041beaa6641b9f0908d47c0dfb3b48a2b89794bedd11e0295bf476c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
479KB

MD5
a703dae2aaf8d9199b29eedc4e70d6cb

SHA1
b51aa1eb349967a6f74e2195f3fe58fdab315f30

SHA256
247eb350d49b2e286302135e95b683118f7928210ee786d09e617855335c32f9

SHA512
2c8c4f8d335eb23fcc286040056c4fdf061480e4ac5dffa0509106307a9af0a39151b009e64694999178f4493354b6ad8859c37cdd3755cc8cac667c98fec79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
89KB

MD5
6c66566329b8f1f2a69392a74e726d4c

SHA1
7609ceb7d28c601a8d7279c8b5921742a64d28ce

SHA256
f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6

SHA512
aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
18KB

MD5
74f49bcdbd13777670657d78944e97f8

SHA1
862256addfc55950fa4b4da43e5619c24722bd31

SHA256
1f4aa7693f801ea02e189c3b85101e1a5c24ffd6c335d54d1b212f9981ea3f05

SHA512
c699383350446f3f665418edaf74e4e235532963801ce3c9fd57f49526aeb9b8fb6cb28fd9bb0a3e65a0521029b4d1821eade0e8a5d56eeafdca244650dd9f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
259KB

MD5
34504ed4414852e907ecc19528c2a9f0

SHA1
0694ca8841b146adcaf21c84dedc1b14e0a70646

SHA256
c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

SHA512
173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
32KB

MD5
64d3be46eb793f6fe19bee805638cb80

SHA1
93bd75cf654214f8a76af8e1290499147d971c5c

SHA256
74c048fd2c6c9516438db1f627419a783622abcdc0522a5c4a1a568317a3d13c

SHA512
4646ac163dcc465669a868003b2667752eef8cad1f40dbff48c7f5d4c5f2120637f2514a0202f2008d52edfb377d1341d1b0411e556011ce9e2de194ee405908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\020f372a2e321f1c_0

Filesize
1.2MB

MD5
7bc0abcdd2cadc82e4f8f5a2cd0e5a26

SHA1
b0147747cf8014895d48bfab3a6c2e9538a1db32

SHA256
63833a755bf711547a897f538bea0d38e4cf65b3a143be7667743e377fa8e713

SHA512
86baf8da97e1882c9db21231d8ebdb7afa06a52412fae40acb8685d530135851e569f5dd2b0d732210d999823cc1fb7faa84233bcc498c18f5900f4a0ebfcff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

Filesize
272B

MD5
4fa23ffa6f64f7a42abbbc2431550eab

SHA1
9dce9c869db049e600072f9827bb13a924ced095

SHA256
2593288f38525a8859f3f372c1e30e85b00aa2d568240a272e47e3ccd89b3e1a

SHA512
e7dee7b4d58f52d9669e6338c46cccdf539c8238e066bbde878ce8964d8a5c17294d51b757d7b3a48b2ca1ebdca025e0767e75585035bb52cc141744fc98ade0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\50616771a20a442b_0

Filesize
297B

MD5
789a520d0a2287d387da3c918ca15f86

SHA1
8ad451da162d1df1e72c8067f677cfc5654d29af

SHA256
a0aace4edd6792d487799a2cd334d6fb69dec10b8a3b96668f9674c60e1f89fb

SHA512
ce9965cd1b3734c279bc77c3deb0b6e309cde3787d14cce7544a2e35869abcd9c882839c0e5cff4a2ed2215381a39ea8a83b481fbff7b90d9500b703d9d62904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

Filesize
291B

MD5
10939bcb855bdefd1038f9a68b56303a

SHA1
0058e96f36a330d6cdde145cc9731dd9c0f822ca

SHA256
b1b3a98f15760721f49f9ff26645c7ed7b9f05117446d2cb44d265017c346131

SHA512
4b1dc608313167e4d59c18fc1de40073881ef3d7002ee85c43c2984d32ca6eeba0b72abe8f43257d59e32cabec0b0aee3563c7c886d94b0484f793cc841bd604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6effd0f0b9d12992_0

Filesize
1.3MB

MD5
74c7129ce3ca488882269273ea19e8c3

SHA1
d6ffca4ccf569ba4e2d91ef1ec0426bc4e388ec4

SHA256
dcbed15271b9a735ccbcdf2f7626844eb99b4ecba662f37eedf90cd4b8fee74b

SHA512
0f6650c0041b0b7049f0cffb2be8088aa35a97cc90a61756275b8f0d209067f40eed2a281a159b778db33df17087a2f1470a653608cfc04af8ef60f5d241de70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9b76fef7bbde4478_0

Filesize
1KB

MD5
5f8864537bae125cdc58de46b8b5201f

SHA1
8f9a7753f8e62835262fb08b2d60c193bbac1a40

SHA256
336485f17d6c45d08c2ef51e745bf311b71935c36b87fa8528595c803b11615e

SHA512
b1e40f03f2cc4616c37a64d81367935d29350e59736df6b85920f8b9f1669f4066da25b8e793ab8cccb3314f4e9825cb20d6b0d68d6a75f25e0e1d253315c195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a3291bc795684376_0

Filesize
188KB

MD5
59cf2f21625ae6ed2b5b3c76dabd493d

SHA1
12371e39b5db441f899659ebf2121d79152a6724

SHA256
46ccec8b38f98815fb456d1d336112033f98fb92788cad665acbf6ee16dc4a42

SHA512
c346b8ed036b297c4bbb99c5283644564845fce7ecaae7350c622bc9fbe8f405a4668f68e44900d00bf0b3acaa4607cd64608e04baec53cf5844e0fb34091648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eba9f8bdc725c64e_0

Filesize
295KB

MD5
6b76eb1b3da33bfcb73ed785abbaf742

SHA1
84f848e5a2e5c0cbd8bf5eef513ccfa278af9ade

SHA256
c4f4e4b19ab9f99d0e97d5fdbee9c691308253d440a770760270d0db8f7fafb9

SHA512
5b0d138b4f23f2bf9b5ded423821c4f0a6bd6e50b7f02742f3299416c8f6ef76edf81578493412eca5bc26c52239491b0140ce5db8f5be7ba1f470fa7584699b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

Filesize
269B

MD5
c303b66f95bd0d6302f62127262f73e2

SHA1
9f3980c43215769a593b99e9bf20628dc20fa74f

SHA256
c656fbb23851907e4e38172c1799af196658d76a4a20ff7edf6b0aa6c32656f9

SHA512
3c0146c361ceb4d97f0095b00058ff695625542a27dda20041f09ff8bd6ca7d4011f43b5c2b4b1744986272a66a0abe6ee9caf9837d063865117bfb353d4b120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c14ffdb8ef9d426271eef08fed58bcb

SHA1
5a85e9455fd5622b529217284d2992389b7cd68e

SHA256
fe0464b1edb53db28df3b0880374057c4295d0f10f5b97a2f4290db468d5dafc

SHA512
18fde5fbc63ed40e2fed50c28952721ed379c173cd75133ec4d721bb79ae58144373189e9794db7b6cdf6fd7e0f54f93a3953ded979a09cc35490ae182a5a3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d7385673297fa30c81b140b6618434b7

SHA1
2ca31ec32fa11c3086e2fbe9918ebbece32fb621

SHA256
f1c4ef6685acfcdba3cbcaeff7fc5e2c5a2385c0983c966fec583d741a22994b

SHA512
750537c6842a9329e46513ee1208b50ca73b64550b695b32b795681dcd58a5208fd6073bc39d8469a9c12082cbf759f83d4260782563346eb75e15a85712f185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d93cc60de0862e5ba687c2a0944ad90

SHA1
695945399e4fc7d1ab260a65145d641f632c576b

SHA256
2f45a7cde00dafd9a47209c91b40f91120ab714d4ab44070b237b0bedd42ea18

SHA512
678e54e4e159b92695f4f10f6bb4bda0372c219c68c11bee13324032bdece8fb135260a72a6934bdc48456ae60d69f1fdce258ebb1c988e6e35a416401fc8fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aeaa0a304675d11dd0c9e1ebc1d99632

SHA1
18099b27ea2cf3da93347da87e3e1bf59d783010

SHA256
a942c0eb6bbfa2a74183c134244b1f29f2e2daa74f3ce3b5e8480c415615793f

SHA512
7475284a9eb75306d98b081c8e95ecd9b3371475ef61d8f4784f8b8b005aaf33dddce08f062e86f2be97470c2a9c7796d7f65744cb8e9141b9e587361cc0adfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2306196fc780db44424f454d2b9c8e69

SHA1
0c95d8d7c8fb298a91208604015865cd8f1b47c3

SHA256
74d5001339946c570840bc30ccb9f6a0286bd122df9409d0b278481514447960

SHA512
bb327cf11363a30eeeae6f5eaaf81e05dbefce04f289ea513efe23a172abf651981e81d95169a6923203971a979eaaf3f34971ab88021e38e4b5a0245b1a083a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bb59cd4ba756f397ea35f3a2a21559df

SHA1
a9305cfdfafcfa1743d9803c103aedf87411236d

SHA256
60289dafe812cb7cd2bca03bc4b2f77fd2491c6a8b3ee57fb99b1aab2aa9af4c

SHA512
17aea2c826274f9362bff4f916c8e15045733c80aa7e4978d818b081b0840ea7d3124088899d221be5aff962b4b94ed8e5d0d451c03e81161a8b0aa19a174bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b9497f56be74cd5248e9c0c031c75b5

SHA1
8e9ff9577d8525f185594101bfcd7bf324bb93de

SHA256
9e11e02af925e4d27103b1881380c5d4eb651c68ebbed098c1ac6112d7bf6062

SHA512
5c22b779ef70432182775fd6517821c67bd4a96d330b67de44479775e88232dcdbec3a9dfa12c3c54309446c3a99fadb005182715a98c1052f5caae3fcd09274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81cdfcda869d2ab1b78f3718a0d6ad82

SHA1
0c967d30115e5998ceea0b892f62706e852385ad

SHA256
bd3c068b0807430c477a090348fb52f1c47beb44918e5bf6fb7d47eabd161abd

SHA512
eb984128e6216e8919b53ad1a6a36573afbe7d9d394d3e868b3a551a2a0dbe2bafa161589bc58a47dbaa8cba7c1cbee995023d41220b9b081524bbe53ccc7870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
426f53e3480086cd368e0b30faa6653e

SHA1
1ae057c86db774dbb85ee6ac1944a21ecf4fba4a

SHA256
8880b19027dde0e51f4748d96230f3a4af546602f0859da26d22a4165fb7e664

SHA512
05a90ba3e61094adbfd3cbdde6642fc7a86da48e8428a3a4f62286f54c190c2e397a40982c797a97880e000dfe348d052aec7f87cd10ebf09e0da0846221db9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
56df4646f5f98856154110f70bd2c053

SHA1
0178176a6d261ceddf23e35af1234fcd297a0cd5

SHA256
f5de918f9cb639dcac35298dfa6a38da160ba5d218bc86ded7b4c0b1d0d30f27

SHA512
844684c3dc3587cdf68a1908eaae9e9891ddce53905c8c7b23ace2a33bfc7e6db8a01e74681b74d984986a217ae130cf0d21fab3d929faa7123605290e305549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
6e9dca74cb1d413c3769907189955e83

SHA1
e22133725acddcb66ed8da3f32b4b72330270945

SHA256
3d9d22be23ef3798187681831e24aef6e22b15c7d75b7de7b2f6134888565034

SHA512
5a52806cbadd930fa4a0986120795af837a71747047e1bc88b1f3afef5e73944b6e024ae6f0c9d8670e50a112373e8df9fdcbaa7dc6be68c3de45c35e49dc082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
409cc2e21d849f7b7415f2b557d2e37d

SHA1
d317c77bc34415136b1da80605442fff6ee8054d

SHA256
ab955c3947f263fb3e2ba7edb5a4e8da2211d19ce6df61b0bb1fd879a3a36415

SHA512
cab7a0e4b22dbf3002dc8a69b5051ff03cc6e4691faa820160bef4047c6e2ded74ff7363235f77acee1dc45b10e57431274615106716dc4eaee499f736c3d4b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
5247a929cd2c7f7ed7e05c2a4abbae8f

SHA1
052aec945a03c4d7c8175bed82d07c8f4149b4f1

SHA256
b77da4bf428077fd34fe360b99ba15b9fbd1f8628ee37ad5847fb5a4fb8312b0

SHA512
5e307083006886b59cd44cf5837e30440e94272415b23be85731c8d0f287ad7fe5b370ba96d2af5dbde4a816ea4549b0737c06d317f91cd43f35cbe8b2ade6d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e87b.TMP

Filesize
371B

MD5
318e71ad495fadb0bc6fc719ca213ffa

SHA1
fa1280243ce98a052327e81b8d697658a5933aee

SHA256
f0cbf979159ad02ebf3ea21c31fea6587b8e891b6be6126f9f8c15037867562b

SHA512
d9c4875038bfb1072715f376a2f57d49d27d932b6b6346af1c31f73d5df9721d92abd783865fe6f0b3da8137ee59f00e93e0a4056f91c6f76511da2205aff206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
307648349f7aaf4b2b7410f3ee4d810b

SHA1
4dbf2193127403f2bee6a549fc93735f499283ed

SHA256
eb61239bcb587238d72c1105f3012f1017528bdd6c446a9d235ea7fe5a4958fc

SHA512
a24a6c6e1f9e5d8868d2fbd63cb0eb80aa4ef19e7c1cddfea75c03bae5877da22588c7adba30154fbb5a4eeeabc65fb5c59b389d8af2a9a3b04a78ae900224da

Download Submit
memory/2136-3-0x00000000002A0000-0x00000000002D8000-memory.dmp

Filesize
224KB

Download
memory/2632-96-0x0000000001000000-0x0000000001038000-memory.dmp

Filesize
224KB

Download
memory/2940-44-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/2940-478-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/2940-241-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/2940-1-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/2940-29-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/2940-136-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/2940-345-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/2940-54-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/2940-0-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/2940-582-0x00000000003D0000-0x000000000052F000-memory.dmp

Filesize
1.4MB

Download
memory/5068-544-0x00000000002E0000-0x0000000000318000-memory.dmp

Filesize
224KB

Download
memory/5704-419-0x0000000000C00000-0x0000000000C38000-memory.dmp

Filesize
224KB

Download
memory/5716-650-0x0000000000F50000-0x0000000000F88000-memory.dmp

Filesize
224KB

Download
memory/5880-309-0x00000000006F0000-0x0000000000728000-memory.dmp

Filesize
224KB

Download
memory/5976-205-0x0000000001220000-0x0000000001258000-memory.dmp

Filesize
224KB

Download