lokibot | hxxp://google[.]com

Analysis

max time kernel
1049s
max time network
1050s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

lokibot agilenet collection discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot
Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
2252	ColorBug.exe
4228	ColorBug.exe
216	ColorBug.exe
5740	ColorBug.exe
5792	Lokibot.exe
5824	ColorBug.exe
5896	ColorBug.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/4052-1037-0x0000000000E40000-0x0000000000E54000-memory.dmp	agile_net
behavioral1/memory/5792-1142-0x0000000004910000-0x0000000004924000-memory.dmp	agile_net

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	ColorBug.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
169	raw.githubusercontent.com
168	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 1748	4052	Lokibot.exe	172

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 64 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveTitleText = "133 236 197"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Window = "13 21 79"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ActiveBorder = "149 175 137"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\WindowText = "193 41 194"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ButtonText = "95 181 11"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveTitleText = "129 26 252"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\WindowText = "19 26 122"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\TitleText = "7 121 62"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Menu = "120 240 76"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\AppWorkspace = "58 33 170"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Window = "220 229 115"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveTitle = "199 103 92"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\HilightText = "157 167 74"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ActiveBorder = "168 134 94"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\AppWorkspace = "93 193 255"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\HilightText = "205 89 151"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ButtonShadow = "243 189 117"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Hilight = "76 248 151"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Scrollbar = "146 34 41"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveTitleText = "198 99 63"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Scrollbar = "95 183 63"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Scrollbar = "40 20 123"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Window = "157 162 157"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\WindowFrame = "3 157 84"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\TitleText = "15 28 104"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveBorder = "227 31 251"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\TitleText = "15 67 71"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ButtonFace = "59 201 74"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ActiveTitle = "187 129 185"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Menu = "219 203 193"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ButtonText = "88 216 132"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\WindowText = "21 172 144"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Background = "24 50 48"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\WindowFrame = "171 86 14"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ActiveBorder = "54 169 151"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveTitle = "251 87 27"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ButtonFace = "179 162 107"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\WindowFrame = "205 91 178"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Window = "222 156 38"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Hilight = "172 237 46"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Background = "34 246 81"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\MenuText = "137 140 215"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveBorder = "84 65 57"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Scrollbar = "208 104 234"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ButtonText = "30 152 116"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\WindowFrame = "88 75 199"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ButtonShadow = "200 98 7"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\TitleText = "154 213 48"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\AppWorkspace = "202 46 38"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\AppWorkspace = "186 159 191"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Background = "205 254 178"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\HilightText = "248 201 231"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveTitle = "147 7 199"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\AppWorkspace = "211 99 204"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Hilight = "91 163 175"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\Background = "129 217 46"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\GrayText = "253 104 30"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\InactiveTitleText = "234 92 5"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ActiveTitle = "73 83 234"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\GrayText = "56 25 6"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Colors\ActiveTitle = "16 16 143"	ColorBug.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 999754.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 197343.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
3064	msedge.exe
3064	msedge.exe
4252	identity_helper.exe
4252	identity_helper.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3272	msedge.exe
3272	msedge.exe
1016	msedge.exe
1016	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
2008	msedge.exe
2008	msedge.exe
2896	msedge.exe
2896	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
4052	Lokibot.exe
4052	Lokibot.exe
4052	Lokibot.exe
4052	Lokibot.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5792	Lokibot.exe
5792	Lokibot.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe
5392	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5392	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	Lokibot.exe
Token: SeDebugPrivilege	1748	Lokibot.exe
Token: SeDebugPrivilege	5392	taskmgr.exe
Token: SeSystemProfilePrivilege	5392	taskmgr.exe
Token: SeCreateGlobalPrivilege	5392	taskmgr.exe
Token: SeDebugPrivilege	5792	Lokibot.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2504	3064	msedge.exe	84
PID 3064 wrote to memory of 2504	3064	msedge.exe	84
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 3212	3064	msedge.exe	86
PID 3064 wrote to memory of 2768	3064	msedge.exe	87
PID 3064 wrote to memory of 2768	3064	msedge.exe	87
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88
PID 3064 wrote to memory of 2188	3064	msedge.exe	88

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffd446646f8,0x7ffd44664708,0x7ffd44664718
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3123646949246354521,7663681416415191147,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd446646f8,0x7ffd44664708,0x7ffd44664718
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9445419270748873752,10856317059652545094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2008

C:\Users\Admin\Desktop\Lokibot.exe
"C:\Users\Admin\Desktop\Lokibot.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052
- C:\Users\Admin\Desktop\Lokibot.exe
  "C:\Users\Admin\Desktop\Lokibot.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1748

C:\Users\Admin\Desktop\ColorBug.exe
"C:\Users\Admin\Desktop\ColorBug.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5048

C:\Users\Admin\Desktop\ColorBug.exe
"C:\Users\Admin\Desktop\ColorBug.exe"
1⤵
PID:4284

C:\Users\Admin\Desktop\ColorBug.exe
"C:\Users\Admin\Desktop\ColorBug.exe"
1⤵
PID:344

C:\Users\Admin\Desktop\ColorBug.exe
"C:\Users\Admin\Desktop\ColorBug.exe"
1⤵
PID:4688

C:\Users\Admin\Desktop\ColorBug.exe
"C:\Users\Admin\Desktop\ColorBug.exe"
1⤵
PID:2252

C:\Users\Admin\Desktop\ColorBug.exe
"C:\Users\Admin\Desktop\ColorBug.exe"
1⤵
PID:4912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:2252

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:4228

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:216

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:5740

C:\Users\Admin\Downloads\Lokibot.exe
"C:\Users\Admin\Downloads\Lokibot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:5824

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:5896

C:\Windows\System32\8zj1cq.exe
"C:\Windows\System32\8zj1cq.exe"
1⤵
PID:6072

C:\Windows\System32\AgentService.exe
"C:\Windows\System32\AgentService.exe"
1⤵
PID:5664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
92b7ee90cb6ee71d3e49153ff23c6ed6

SHA1
868fae0e4d4169e57991c90123d7ac17dffbb0d7

SHA256
ed23a79b8fd86a47c392d5426b2377d01e2c653d8a0af6f8b6310be230ffd6f5

SHA512
74ec22f8beef2c0feefc4b3f9e261f69816b690e214d757fbffd830d51552284daa513fff83eddb60d066ac8dea7b7382e4b90f44b12aaf7461da204f7857cab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
cd59d85e10aa13074a0a92328ad71199

SHA1
996ba8b33bc84d6463b2cbba45e6d4b26f6d3a18

SHA256
aae128c2e4c9a84e462f86e98cea1858de2c82576790944467596daf2d491a08

SHA512
11d6d34719143e29437b7b75207811fc8edd757a7917994ff2873c7947fe20aafb309f32758109c29eedc0e178a44aeeffbde0e3a4fe53ab6da86e2e25e79e30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
05c761654319b6cf0a13230329b25dd3

SHA1
ab278537fff6831494d94fdfdf01b965709a0ca6

SHA256
a50809dc5209313349477ba8b396efcc6bbdd6342f09cece0239d30eb8664b4b

SHA512
5fc80907797e6068d2cd29d78b4e7a907424f31daa146d03760822f221bd0229f1545a1c6b069930ee0b005acb2aff6700377edc48aa948323da189345b34a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
dbd6acec3729752a109fd47d1a05f8e0

SHA1
c7d38e499ba275d47bd20a362dab5a1b09e43367

SHA256
06f58e0661266e1891b1a491ec87ffff82f3368336fe7e7adc0912e618d45e56

SHA512
c7b26aa953382aa83376ed3e641713cad8945804ac2977d0623ec79d3d5cc40052b020ccae68acb6aede2dcdf9327bda38ee18e4d029c2c7cd1e0e44501f61f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
b74abe66492ab3ed5e6fa0d85dda0779

SHA1
cbcb1e114449efd8558e083a8d498d6117ede8ef

SHA256
2373137e9b0ddbf6c5f913e0e7ce645e3917c548a5d6733e125e464a69f54899

SHA512
5ba9bad5830494db1b86f6921f4f64b61a694261347ffc2cbfc9deebb239f5a1a5a241a48c609b88109b39ac16de9948659f6464ea6325b3c78d31e85da94a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
2eb4f52145dccda2fa981c19ae02aa68

SHA1
1cd6daeefce0daa6acc923a2b99e80ff104cf654

SHA256
ee7111b0bc2b5f1ef703034bec8e1f43d4e735740df42f8f95a7642a4dde5a42

SHA512
6c3bec1f532c4cafd098b754489821a61fbfa2e06503b09f5a8e080136feb26f4e784b17e4f4f463443fc147de594446f542b0bbfd2de635988787a26bd95d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ab1eb5880e859a4c4866176d1ee33030

SHA1
fa47aa70b9b8db9438a154667a725110af19446a

SHA256
64274cd233bddb39650d6d2f70f7a8610b961c0a5a52ca63020866349a6440a1

SHA512
472ab2904d441d8234e6e51d1177879606cf95a90928025347d154f36664cc6647a67dcae9b8fe2ba0f4c04c56e8c14749da557dc480f437f9d566b1afe5f47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a7265972230008d8d49b0842a0ba928e

SHA1
ff8c999a976f42c0bc23502d7ba35d737c0aa8e7

SHA256
af8b5af88d2f4ddc8ada151cb726450fc5a0fd142a171b604c6628b668b3f24e

SHA512
cc1069d85b8d21da12e362c2b80dbd510b07be275d6478b73d0da6b3210e306c097c67ab314d0dc8fce3a4159b53ef074a93ddccbde6c435f64349e06e180504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
423bb4ce6f42cc4b398f3eb85a05a2dd

SHA1
dc26729354d74f6622273bb024c68c7f33223c79

SHA256
5401a8df1ba0929e3cf22259f10ce024bd58c24c70d25dd1436216fac13d59d1

SHA512
f3c2dd5ba02d32cf0eb5a45d501fa9e5e2b5fb50160a723f50f0fafd276527985ca65985b7d79a0637b63a1e67d966952135ccdb2d542cbb52068555c5a19b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
8dd92208bfcb7716f83c15741b1f07a2

SHA1
0ef6c3774d7e8e5a8caa7d72162bd1857fc5e184

SHA256
b38cc105ab71ffdbc2c17678ee3c607077b352d754e81d93dee1bed53d1f70d7

SHA512
8c21d667518e6c4056ce937b5b96c97445a5283c7d05b0be620b62508f9e3cbd4175536ac64321d45e65fb208c6f6af917f06dda903b04faf0013b49f5e7968b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
24KB

MD5
894503b72d2ab24f3718686acb131199

SHA1
5b2dd95c8d2d67855782604871620d4f81996b76

SHA256
f434fa64062b44c64561f3988d229b28eb0c3951b100258a2eb65ebaf74c7ec0

SHA512
6dcce7a216d6f2f5958fc1634f91e8e4ef48c745d7e9ea0745e52bc5605ed84c1104d499b8b111b6a53012c5b66bf301b9eac10355b4e055cb78c36582cd8ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
086a4563b3861fff046ce3083662f8a6

SHA1
70220fee1eb689881a4790553902eea6dc335c12

SHA256
c43a67ade0a16e153690a9fdc7649e84e874d01e42ee8e3bf6e6c4b7e40a9a4c

SHA512
df0a4136a621e6868fe90593f931863bb79e94b4f9ae7e384f24ffe7d494925b99dc232fa84da203ef69037a7460688c7d861ec29d2d1a6ca719cb026a925af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
132KB

MD5
afd31a6bb48a3ae2deb9294864ce2660

SHA1
f3c2512a32ae689a7f46c7e8c32058e6ecce28ce

SHA256
a68cc2dd218f0ab88b2526de052158d495e635af7f379304d12924c3ce26fbf9

SHA512
aef4ed735f5ef2da3dc27bc0e7540586f50181e1d06be4704ae391f2c09a85c651eb116259143f17869025d5cd0a2507551b2ea5de08bddc96a7c225cf21f9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
2KB

MD5
e6a2f7bb6d9b8e24da6e9b4fce954c90

SHA1
abe2fac544a307e82c7e2ed29594dbf00836f2ea

SHA256
914a77038b11186cb5fb0ed18a581e0930b4f49c8ca32180ca6385aeb07b33d1

SHA512
21e01919615570d5faa79d34bc8672de9f4ae292ae1542d05082b93cb5c80dddc0170e64dcc657eadfe46d3d53e48a48545e1288f1516879cd442baf56ec7db5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
28KB

MD5
5f300c714f3b333a667e41c66ddee3f0

SHA1
fcaf3dc0f1279fdf9d039b79ce52fb34b5c287dd

SHA256
bed09fd5b9aef7c555075475c5548bd91150424d495639ff88c14f892494cc16

SHA512
80a8f27645c88efba35a1a324593d7fb637afcdc542c393b9c47634b3f1440d9da6bf95d800ccc4119d0f371cd3a0db34faca8cccc726706bad96aaf776009bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
f7fb77ebb9899dd3274c6054d0fc967f

SHA1
b00edaf58860b68d8a3e300968c8d830bd13de71

SHA256
33cedd61dabec800eeff17a90fd4aec3eaecbbbb58849538317d37a571280dd9

SHA512
bccca437666739c8902c97911d710cc415cc4fcaf6474f82793fe106b825e65a0707af8ee7e8747d0a8cc9813bda9ebaeebdbe3da73e034295f58abbd75f4922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a83449642379cefaade57b9eeba15f02

SHA1
9ef471f3fd28da8cfe71db051e402ad13f14a43c

SHA256
4b3d44535c33f253641686da51f77ae233880c46b2b2d9693cfaf2dcd6a699bb

SHA512
9e8a9929e92979c31bfae0e90cc88481134ab272ebc929e0970f14e037205e7cef01a737cf2f35c8bb9f65e1bad40a1248a2c5208d20d99a7399c898816e6303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1f7066bfb1f32ed08412394ca1c92a68

SHA1
2e4b9118b7204bf974b60ad33e66f1be766e4fcb

SHA256
cae77fd77d03b0f70d186f8d7ce0de65f55a43668f1a2230d62e11eceec0cbe0

SHA512
13952472cc16e16b58dae538763ab48ee0a4a30d810a7e15f88710a7bd16ebfa26f73bbb496c9e3ffceb644bf69d820544aff1827db31b544bc6537936976acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9707a32d41928fa5b796720d9584fc8f

SHA1
e5a8eba47b3eb6721df0060ced7f27a6e0c3c42a

SHA256
5558a27b2901888d76ebf0272cfe72eaa2a3cef254ad87fd584ac4f7a8e5237a

SHA512
61f542f5ffce0dd5dc3d335ce6970a09a7c7c45a939f9001a0bcd0ef9dcea9be4e98de9803602a0f750f48ba5c3f7226113660a3a049784e45a9aac39cbd4f79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f017cf09fd28e8aa58fdef5bdb6a181

SHA1
dcb0f3cc8eea18aed2227a1f741a5cc538aac594

SHA256
371b95ab2b32718319c89a9211040134e8a251f27c1cdd5fa57b81ffe0309bc6

SHA512
0b62b80a1bd2ffcd528687cac500c74a8e088d499463d74e899e9878d9644c2791c859518f44856217a0af4f82a1222019b1c0961724646640e4545389db71a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
67efdf7219d366d559363603888520c9

SHA1
c696395a3987c3fd9d37d63d86980b156a20d946

SHA256
7f0ba4fa9bdc9306a37599ccb61060207f324aad71b83b30af9309ba39b8ad1f

SHA512
c294c00057c99ad84b85c81071a55ccf1882d12f9401d4422e0032d6c6c627ca53791821be25836f9f2d7869ca010ed032c74661d4320ae892f0511f7f05a864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e34f7cc11699fe9e29c6887f56161afd

SHA1
1dc97a660460bfd9ba565c6db9e7d1f9418234f2

SHA256
706bd17c9eee9ce23876a9d32c6fae85efcc3ecceae048ba93f4c6f0dbbeaea6

SHA512
b9e2c18ebcdf226b84a9472f379a1816372b840183fdbfba74acf79fd4648a32e45cf1f22416ea39c9825110c87393bf7d609f081f3ab3ba043ff7929ee656b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3a5b6a86f81d039c461e13f39adaa85e

SHA1
3245aae0fe03944c43524a67013d3e18631ec7a7

SHA256
802ca629049a1c897c0ca8a2720e5a3dd2646ef9b011d39b97b8d7eb31a74788

SHA512
c0a04c5b9289421d21d14973b18e58e7673c57fc288eb62d6be5f69ddb9a19dbde2418e537a8d4fed9e05ec44322b7b6b68c721ae1a7ffd64ffff089f61fd517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3c7b9bf486694fedafa4284f05ce899

SHA1
cc50d27a060f3142872a71d25d2c186eff9d55e3

SHA256
ed52c06f6cb82a1fcf986078b8c1ec84fcb7adc4ecd33e84cb8c4f89032b8559

SHA512
3b37d0443c1ca09fec08c468d35730612f15a96239e1ce7cf2f20fe509318d2991c5ba7cad7cb7771711dcef248b7d6d5c9135e0f861d41f3595831fd2e704f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
27a9a07098a33e3d7db09629a4c666ff

SHA1
5dad8b70fdb6891401d27f45746817cc1a17715d

SHA256
24eb90f9f954361822b42b7c8abbb91b25ca88cc9c6bc5469ee6c6ad7b5f8462

SHA512
ea4b4e51d2e03bcbaf796e3fb4c02379387fe6713a29e1b88818c556b64cf9c12c21103f0dd13787b796b00b7220f5a34b8179a79f4046189e1b5564885f14bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
38966e06a83991bfc33986b2ec01cb69

SHA1
f1e150b83a8d0659a6c80ffb077730124e69b7bd

SHA256
67c1d5eea21ed6fdea7556552c513522c13ea8c2007bd3f0106815772900020c

SHA512
c391172cd76be15af429f0121e47591cd80e24972720bf43d99887628ba19f7ae4493a54923325af9ae395b3bfc82117f86c4b84fee86ca1e4b8a2fd8799ee66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
be95356e9406d9c6c5d249d0e28f6c42

SHA1
62f85abcf0b4348f200f849100145c174baa0ebf

SHA256
976009e5e7efaf7eb309c08d48ce077d5ec440bfa0582cb6ef69221ff40e6bda

SHA512
233746aaf99dc1f30716230f265676f9e053cc6fff80c945e441c248f9b7362edc7548795773f2d76bc470491b21c209621fb0aba87c321f0e4b567909c556ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1d4d278b009c8f8c6c2ee55020160be1

SHA1
396bc6942f73366ed6e738ef41fd8ac7ae32e22f

SHA256
c68284d8eb9af135da06b58358c20eff6cb9818ab7ae5464ea205002c023a248

SHA512
aca6b537578ed4073423f226ceb6c566ba5805e8124f036336ee981a0c67c8e9cbc1398c24f50e1a5c3a88acb8b96770ae4d566a076b20f87683fe53e7e81371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2c41a7635ed0f10657154974122ed004

SHA1
fe5df3baafda25811a2377010b6c7a32c7d5e127

SHA256
edff8545d1c67525f1d7ec4b4fd65e6068c1fbfa8c877b030bde25eb75123dac

SHA512
f4e01be18587411c1d20d48cc84bcf18689fb7636ec7575acc87da6342f40d11f0e7a3bc7ead3dfe311a16981f459c35aedb5e4fb1e97ed95f4b0393949a428d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000004.log

Filesize
48KB

MD5
08450b570f12fba1f23626dccbdbbc75

SHA1
c2d4f25efc50a9edc5581c5a0b8a2f22cb9d8231

SHA256
b78a3decdd3701445eac44bf8df7bf831121656cb2bd2b1abf3ec6f94f15bbb1

SHA512
4f7f3dd12c769963e6e8fd83613d303dd9b8f68f576417f1e820491d793808557485d54a953f9222062f8d1ad469932aa079dd76dc0e4719b79febd7c90ae895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000005.ldb

Filesize
356KB

MD5
fe853b7d23674e1ed4f41cf3976ee268

SHA1
730d79abb9f50fb8bb2efe0856101377e24b259d

SHA256
87c6b6a2cdc0ae0d05c609b488e70b49eed96cfdf42edf77f4265e730ad3cd78

SHA512
7a6dec9152c86e4c404a13dc4880cfef283540cebf8795ca25ffb14eb0eba92ebb2db02c93f381ba73b0d744cfddb39d5402f69785f5abd9e5e56b2e74fab40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000006.log

Filesize
25KB

MD5
0b06d3596ab360af3edc4582ad9f6374

SHA1
aa3764121554a237cc39c270dcbe9c29277dac78

SHA256
5bdb0705c1712aa36ba6088a22528acf3016241fd0766e184e8497b479d5be5f

SHA512
526f03c06026161a4d1132c6708e73d5eabe3823186c3737e858eb813b90e2f93dfe2ff1c5e88b13429fe2ca366cd81e09314ce5f08155100e655b692dd0f8d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000007.ldb

Filesize
14KB

MD5
2f0cb11bf1dba499456b884ab3300e15

SHA1
1b5fd49becb26ae4f6427f5498b47059617cd973

SHA256
3ece92fe2e5b6f5ddc25982eb27ceb8ed02ddd6d5111530d3de2605fbbec7ba3

SHA512
66d0ab8fa4d2438b44e6f04a23254d14f6ca31cfbc573ba284bf034ad1552cee0ea10f6861501f9e135a4ab10d5f5fd63d3de15e2151c7c3c6177579c4ef218b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
601B

MD5
4b17173aff55dadad30e8dc388739a4d

SHA1
af8f4e623bf8ed8e693037cc366bfd29800b111e

SHA256
d39035b87a44a69fcb820f2ca3782640fad72a9566bb1607c8be14721f835c8e

SHA512
278fe73fe1e416835c7c4916eb1edb4bc978c187d429aefe8a7d84dc6030e888be2afdea04f6e5a9444501f3762e50049e9aa7be09d9cae188475d3ee01deb39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
275B

MD5
b9a8cf5968d8ce0f9fc34fd1c03a3d44

SHA1
38cc37d57241b2aab7330f8b39cf57912eeb85aa

SHA256
9d72f180d393975b8354e9a126ff055199674ca8be7406cd9f2f0ada33b8662a

SHA512
da7eef8a75fd84cf5c992b66e4bed8e2764f9c4357d32916abaf144d0fe029162778a16e3602a7430083afe15705d1d58417be6e59533031dd1162009ee5856c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13375135066577435

Filesize
235KB

MD5
21073f6d55e9314635ce639eb47fb966

SHA1
f79f462aa54148a86b9ea840ba3c413be28caaa3

SHA256
ee0db16136c70a3222de5a245636a17820da37bab70eb13cb617ecc07fd9e51a

SHA512
c250b3a8bb9955d71642d8e0089179954a6f544e5c73b6fa3a4fc4d9f7355f7ff5f438e5ac50c2ae8cde3c8868ea6c5a0fe919647b267feaf103e4c4ea7f86d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
220B

MD5
8da1bb0b3e83831357331da1e3bbac49

SHA1
c1a47f9e382c8f3f73631cd2a07fe7407e80ac8a

SHA256
def9836deda8d4839ce1190d5b800cda719ce244debb5856756b4f027c36c8c3

SHA512
420e8c6121e9e49bc81c932be578c5ab5ec2a36d01f3375783eaa4fa0d3b56b86e4521ecf2d8028a25ec7124a82491b2ec5867aab894da58ecfdfb9e84c5abb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
6b94f1a9d89edee80de1ad7a657672b3

SHA1
86faa7d67579006d965abe72fcd1c7dff26f853a

SHA256
5c6267a6139810eaf25c01a6bb4a6e13f9a20b63ac5f69aee274f3f714239433

SHA512
17844c9f55c391d95a1837d375d0f35213b98001d38a6ab90a832fddaee0e7a10ca832d1f6f99dca8840f536483a5919cdf94625078db420fb7ccb94dd851691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
748890654571ebc0a8b97a6f4807e133

SHA1
0d89bc909ffdcc7c206c0b7cae4efe11e473634a

SHA256
de403be571ffe07cdf63e026d59eec46fd4f7fb140aac67859ed666c7754296d

SHA512
f55146fb2c86e69abeb62754cd59b0b367e8823ed05cfd556685b8f3076ecb78ca859972739ed5112253bc3e37c2325dbbc134a64ec9bc73f2307e8158cffef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
abdb01ebc0e6a378c6ec6966ed379d18

SHA1
c06e7339b6ca1b7041e7c560a512d69223c4ce27

SHA256
f96e4c8511daafbc74838cf102dbe7d2f09c23ea5d63c50b9af0dee8639ba08f

SHA512
52551e7a4b36614835cd6dc26d707ac940b644ef54a046d1490b20560c3fb1e93d1638974617f874fd71dfe0733b46fc56fc1871c5641c91e42c963e8783b30d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
710ebf9465a2a839f5ce9aa0bc5ddb8a

SHA1
89d46f852de14bc34635dd266bf529bf0e81720e

SHA256
0fc1fc506048e43d5a23cdc9e2fa1150c880ebdbd3cf4651bca5cf79a3dcead7

SHA512
82e3a9bcfd73035b3940afce814676e255077ecc43714e3b3fb2c0a5b380d13bd8caf5aac2ab675e22c6d4488fbb4e3a68ce711b78a9f88539f82e80aa17a9e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed012511a670d81e2b81b97ea99c014c

SHA1
970029403b82410cf77fd30dc635dd8a779ff419

SHA256
2b80f18a67f35309f7cf0f8ad25cc44d1806ead4e07c4d0fad751f4e6de67dda

SHA512
af49018a6c42b14b7f2f154d480012d41a1cee3c1295716f10d4f6dd4e7fc9993ae688f29773ef1d57dab11888c72335e2fe76cf0d9e0e5fb996b000c2cb1ebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
34ca7d2a7255f6020da250edfdb12048

SHA1
552af4dd1272eb6cc4aa11315af2552726a6b4fc

SHA256
fae5e81411f18feb1530004fe21b205a9e8cd1979253998aba225da3f7b18802

SHA512
706f2427458e3d45383a91230efbfbba04c32dc98bb6d47b5662f6ebf58f65b8361ee8fce32cf5c703f078826766eb8e2d80d065ced6e3a508946b432a6cbb43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6677aade54167b3d9bd52feab07a574e

SHA1
484b5f38edffe1ec7f220eef799f2a719a02aea8

SHA256
cb44a6101422d2e6f2dbc1742b9f69bece534c6022ff20e90575e97e362049ab

SHA512
13340467ec05b4b2f2a4ce02651bb5d25a6ba87f3465107536ea57ae43bd78a62f1a6295a57aa62bed5449f13940de57326ae662c0c86077dccdac30f6aaf056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7993eeea3f6dab27e0bf04ecb4e76b23

SHA1
a0c179e1d96d67b53743c5c53f9de6d5ba17960a

SHA256
445e962857bfe08a8009c7089c451268e966cc48ebed0d9f1789accb0f3bd02c

SHA512
2e962a5a34709da390e594f05fdb155f2fd0965ac1ff628a36d31d21bc5522f96f0411ed62303a7c2c3af7133525192eb22c888d1305e1482a45c7ef4beddaf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
3213c2bcc957cb95df7be6b051d4b8f9

SHA1
37278abf8adbe2fe0e40993b032b0f89f665cd6b

SHA256
3d5187c074855b0340dd76429acb3dacd2538890347fb48edadc855144fbd15e

SHA512
43b7fcb6f5f00e1c974adae18fa1efee00d615862c2acfb9b769b3259c58aec51a2df4b85bb28587422e14b4e44c7acfdcac71744d4cb6e2f7a47e2fa83578c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
54a1e0761be81981fdce50c806ac813f

SHA1
df38c952852a4a982af3b172ada7f89151d730ce

SHA256
79f400e21817555a9aa852f51321dc185d3fd8749b11053c742b1b6e59bd2033

SHA512
71c3d30587c502823c7106aae2e5ca0af99b25f2939745ce1153020e79ba16055f0fe3dff987870cf8a4da730604b22796a2f73922fb280212e181bab749ce66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
eae6e292f80b93e2fac9267539ca002a

SHA1
82db11b6ad71a4ae22e7a3b26227871c026de49e

SHA256
086a05b506a2a8c554df834bf3561a9409ffc4f5ff9fdb8e35f7505c4e924290

SHA512
3389fb50bd1a132db1f3de36a38025e75275efdeb82df48e39740fcebc03e1ba1778a9e320f4dc1ac11f348c2e3718ffcb7620c10f18aac65647d66d4928fbe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a11bd8775a5c789b74b8f7727de0d279

SHA1
4be9e9d482918eaa00f8e9220cd4d26a4f4a95ef

SHA256
0d829050f0558876bdc1b9988e52337011a8f89e9f825ab9aede0c24bb9b7392

SHA512
cee0b4380654ccdaf98348cb35966006d97c5aa1edea41ed817c95f1c4daa3b8700674f6ce2e35fc1bf070c374f5ecb5b8c5bedf6c450ac4837a9f33678a59bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
ffbb5f77aac196164b6b5ecb0b1a801a

SHA1
98084a059c84fdc662e4b7271bbc4b117b270ebf

SHA256
3d539df82b4245602e3da4617e906d416f539aedd4ebdb76c9a23c2cfa12a4ef

SHA512
311494dc34d3e484584b156d417b19c1a8e82bb518aeb2ebdef0ddcb24b7b067f669f74e3581681c434f38b8531f21f161df702508a17e412fb12a4a7fd2820f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5834e6.TMP

Filesize
204B

MD5
bdfe1d1e3cb2376bcffdfcfa2b034af2

SHA1
8a260600075ce55f8655ac3136db53ad0733a44a

SHA256
59283175e9fd7c398199be074b32a2ef4bbb4db96ea9ec0098ead959e9a4e089

SHA512
b9dcdd90199fadbc423aada5acf262aebc9b678640782d9f9a58945384a68ea23d4f6fbfce310fca27325429b924aae8afac253ba3a713e7598c8ca285f5bf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
bf2c08265d765ceee0e820d597876959

SHA1
620ec0d4af6035db23c6c0e60aa935c47a752bcc

SHA256
06091eb09c5f2304c3d42b5280602b30c09f766c4e1d50648beacac8b8dabcee

SHA512
ce6339c358e3b3f35669ea3269c7fb84275c10ffbe86fbba5f4369322dc559637d9dd7b7a0a25e4d091cecb98f8c979a2c9fa00b48087acd5622152fae4fd67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
a78ad6aadbd5623928318870fc35e893

SHA1
9fb58fb8cabda14e872729a0aa81859a35ca656f

SHA256
94ee51350c83831d24eeaa84e8577a5a546bb2cc09b856b7ab2fc4946923bf9d

SHA512
e673ae287a4bb249ef55694f84b6dfcfde3901c0dd3db51c2cfbf8db8495512f62c012e03736a68425cdc3609aa8208c073a7f93f7b72f01b5ba8228b1adaec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
032db79092fe5185d3422572d33237bc

SHA1
0e39845229e32ed2b36f01b4f90e065c7382285d

SHA256
798b24b26a075e50a9f540977413ccf0837375e100809a608afdd107902171e5

SHA512
b5fcecbff13ce3e04c0113d5eba50bd21462f6e6d58895b9e9e64ce248c32cd800e66abdcf7d52dccb10ffc8c09f28a391c51096989437e6633a05fe4970acb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
244B

MD5
f226fb592272495142cfe3f87f49fcfc

SHA1
e2ea51bafc6c103da5a8bc5be41877d0c3fa7886

SHA256
cc5480820152ee00055a0d9e19b3730d29db075bd5532e969aa061d9912b3881

SHA512
b985da1fa1ac7056756546b8026aaf0c4ea9aeb339053deb26f27825b85b70de3bee2cd146e59bdd18cf4a0655e4a1448bc3d97e51b618deed1d7778464e38df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
58a9190697a06ec8ef8aaafffd2cb705

SHA1
849d926110193a7727bf27637aea4ef38de58272

SHA256
0df858cb2aac217f0d169416cbf837a70c94690360f416ccf210963c9c812224

SHA512
32f0425bcfd23c897a2e22fcb14be3bd601671678828a758d99d108518b617133deb9ca97eccd979d0b3872831234813b65dbf87984b555e00a01f72c7de0a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
2d74139095b58340d26a172210bd169b

SHA1
48ed441451c33187ccef8ceb3c83771f989cb50a

SHA256
d2c640c4c0457f601cd6611724ec6ce22f98c3b0be455e66af19b620fe8d182c

SHA512
c9a1cae2e9ff2556ed5be1978d417bcff75fcc0ca56847ef9be167bc1a6a4caf7167c1306b9288788fcfb184e3bd6599807593843821e0923d3740323d40e278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
2b0584b7ac07a8699c746fbb69207e09

SHA1
45d2c3d0c7f5dc24a9fd11a4ba79dc13efd26615

SHA256
affa23b520874e2876ac84ca75d54b713e96243064641b641d1448e3b9562957

SHA512
f171e3f3efb7f3949bdd292e6753868332f07051c23fccacec36922aa316e51ff564aca9bfee1eea1b06ec8e49bb0ab27f57a86727efecad47896fc01441a9be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
9ad132fa8e734fb772fb301f579ed38f

SHA1
0b9e5ce0883922c27b6440e257845d99e7fdd730

SHA256
1f0edd7c4e8c9dd48b28920a59418f0bf9e5c2f29fa24cca73070d71cf23437d

SHA512
af912b7d97b6c0a71cf609f032e33c091958360277e6260825a1f7768f6adac2ed6307be4546ca4367aa80c26571b56d3a54850b28347976a3e0a9cbdc17a3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ef13a7c857c93590eb916b13b6095d9a

SHA1
a200b77d59134337a38d31996b7289f1b5071b14

SHA256
f10265d80953064bcd4fa3e4363d56e532397938f1ddc2767bb7e3866b4ebf70

SHA512
66cd3d8cb195e4edd850c995afc74808ccc791d9fd9882486b002eebace81a5068a196c761a5bec33a5c051790af7175a11adf231a842256418ca2b2c1b9eef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
fc8ed863a6cbf5c1e3b647c1e7997377

SHA1
bfb13e32c9e613ad516908e07f3324bd7719551d

SHA256
0a8c4ac13d1718a42820902ff7d7ebc459022411d3bc7f28f5ff3533c7a1206a

SHA512
302f4523dbcac508fd718972e71e9a5de4b57c978e623350f2fe6fa37a66385b5cb214ed9190a643c2dfaa6f4959f008a73ad82dda26d6d2a07828d4a2afcdb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
17KB

MD5
6bc4851424575eaf03ebe2efee6073ab

SHA1
2d014fe2feb929d03a46322645a94556ca5c9e96

SHA256
abaded8e235fdf329521806af30a1cc7701eaca3fe2efccb9da760ec6d8e5e4e

SHA512
af3b7d93fa2243475d74d4bd7f918ce2706bf6eca28029b9e49869f5f793e483efaafdfab1fed6306d5fc77a5ed3b27097b27448cd04560bed4df6fa3268ccf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
17KB

MD5
fc97b88a7ce0b008366cd0260b0321dc

SHA1
4eae02aecb04fa15f0bb62036151fa016e64f7a9

SHA256
6388415a307a208b0a43b817ccd9e5fcdda9b6939ecd20ef4c0eda1aa3a0e49e

SHA512
889a0db0eb5ad4de4279b620783964bfda8edc6b137059d1ec1da9282716fe930f8c4ebfadea7cd5247a997f8d4d2990f7b972a17106de491365e3c2d2138175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003

Filesize
17KB

MD5
d22cb8682c6c279a568ed39bdc634f0f

SHA1
677360e899085b1fe7af0098575842261a6d854a

SHA256
78b575d52c9342adcc7b89ee8545e0577169b0d520a9924c7d53bc3587b240e0

SHA512
2ad0f705556abae3edb620d4370c1e72c749935d6ec079a10272ba2cbfe42d06a67f6fa1c3d80755aef9419391f701e98d479e946708e26980497f438b154ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000004

Filesize
16KB

MD5
a33b3a3fdf5161be5bd861804961f557

SHA1
68a57897f1686a3e62ce9808165e18f31661d077

SHA256
ac33d8bc6d9a5e769472877d7dd3d035f8088274b886b16cb1898b106da48560

SHA512
c94c29a5a9da89044504fe06702f00a7fdd5bc7b85e1733c0cc9a363a812c8d8f95672ea7731643229fa4ae2f1a632c73096d90b63799f5bae7639b41151ccb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60dbdb188c5f983957f47f078657f99a

SHA1
832542f9e73967d654b74609ff1d7e3908fabe4b

SHA256
75b300eb2c7587024dd1a805713678f939ba301169deb300c0126041a31c2e38

SHA512
3ef82cffb32786a0ed7e71affa63de907f1e6c9edf23e375f119c4147229fc7707a8c8a623f222597252e6787dc729d06afce80533f595921c9994362bbb7a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a20357a78452ac0a1a34aeed99e3e85a

SHA1
5143ee05d44de544f5ac85d30287320c532a8513

SHA256
5b2c016f18f8372d9dbee4deaf1ceca980a1c10ed78f0468ee81af7ac4e63dc2

SHA512
e1cb9dc1024610c293235972cc2989f43384372f74f6b3af32487d347699a5e3dfa9cd63c5fa1256b6f36115f1b434edc32a8a22ee6c35df57c679db47583250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5c1de3633f9ed07577c894710a775276

SHA1
f943dc8d6885daed1a7b8c3db98cda90af9893d6

SHA256
4f5ba479de239bc6771d54f064b70489256ff46c6115fe613143ed5dac8b50aa

SHA512
1b4483987eba0efec64f779bab079ed647729540cab2cb1b4a4fa84876bf5ba8be4875713a19a7a6506e71791fea6fa200a9e444a3ccd80a4a1b3500dbcd8f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7d7cfe0a66bf75a6f725f5f08f9cfc0f

SHA1
4bd2634ebce563c37560dba71dfa8b4603f243ab

SHA256
b20c959563e8b7d1547e2233047a0567fcbdfeb75f30036b11125acb6591cf56

SHA512
bd695e6908f7dc49dce598342e8f770899adf8243633964351cbaadcc2e7d1b69a8b22aeba0e44109df5584c4995dcfa783ac3371f4170f0086b82be54f255fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a5ee4f9d44c1908e529fc5c75f9c88c9

SHA1
9a8c083d39253a1baa307dc6c5bc5cd0cc3da708

SHA256
ca6bbcb05031086c408dcc36304dc43217b24e8b6f9b85c2d896e06c4eedb735

SHA512
82fd682c027054f56cf4c56d64b5401a157aa4f6522197f3fca1290b86d3aeb1e88a0a40fc519e549bc3f7a2fdf14e7f0b0bf7660752aadb923334d4d0d39389

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3442511616-637977696-3186306149-1000\0f5007522459c86e95ffcc62f32308f1_5ab270f5-f3a9-47d1-97d7-bbd50acf9955

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3442511616-637977696-3186306149-1000\0f5007522459c86e95ffcc62f32308f1_5ab270f5-f3a9-47d1-97d7-bbd50acf9955

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 197343.crdownload

Filesize
53KB

MD5
6536b10e5a713803d034c607d2de19e3

SHA1
a6000c05f565a36d2250bdab2ce78f505ca624b7

SHA256
775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

SHA512
61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 999754.crdownload

Filesize
300KB

MD5
f52fbb02ac0666cae74fc389b1844e98

SHA1
f7721d590770e2076e64f148a4ba1241404996b8

SHA256
a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

SHA512
78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

Download Submit
memory/216-1101-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/344-1053-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1748-1097-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1748-1126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1748-1078-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1748-1076-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2252-1056-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2252-1099-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4052-1037-0x0000000000E40000-0x0000000000E54000-memory.dmp

Filesize
80KB

Download
memory/4052-1054-0x0000000006070000-0x0000000006092000-memory.dmp

Filesize
136KB

Download
memory/4052-1039-0x0000000005120000-0x0000000005128000-memory.dmp

Filesize
32KB

Download
memory/4052-1038-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/4052-1042-0x00000000062E0000-0x0000000006324000-memory.dmp

Filesize
272KB

Download
memory/4052-1041-0x0000000005DF0000-0x0000000005DF8000-memory.dmp

Filesize
32KB

Download
memory/4052-1027-0x00000000007C0000-0x0000000000812000-memory.dmp

Filesize
328KB

Download
memory/4052-1040-0x0000000005E00000-0x0000000005E92000-memory.dmp

Filesize
584KB

Download
memory/4228-1100-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4284-1052-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4688-1055-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4912-1066-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5048-1026-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5392-1140-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1139-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1138-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1137-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1136-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1135-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1134-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1129-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1130-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5392-1128-0x0000012B5A750000-0x0000012B5A751000-memory.dmp

Filesize
4KB

Download
memory/5740-1141-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5792-1142-0x0000000004910000-0x0000000004924000-memory.dmp

Filesize
80KB

Download
memory/5824-1143-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5896-1153-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download