hxxps://academycs2[.]com/teams

Analysis

max time kernel
567s
max time network
556s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-11-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://academycs2.com/teams

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
3144	msedge.exe
3144	msedge.exe
4820	msedge.exe
4820	msedge.exe
3716	msedge.exe
3716	msedge.exe
3476	identity_helper.exe
3476	identity_helper.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4820 wrote to memory of 2684	4820	msedge.exe	79
PID 4820 wrote to memory of 2684	4820	msedge.exe	79
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 4680	4820	msedge.exe	80
PID 4820 wrote to memory of 3144	4820	msedge.exe	81
PID 4820 wrote to memory of 3144	4820	msedge.exe	81
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82
PID 4820 wrote to memory of 5080	4820	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://academycs2.com/teams
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff963ff3cb8,0x7ff963ff3cc8,0x7ff963ff3cd8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18285823610168044652,9655618817876213665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d39b42f-3ed7-4042-9909-96d72b1fdfcc.tmp

Filesize
6KB

MD5
7b397ddacdcc8f8d3aa9bdf6e05bab2d

SHA1
7bff23148382ae791171c2c0b2c7c65e137c4d85

SHA256
548441ab630b8b01294d9d19175e685e7d6191270dea2274b84fe4adec1734d2

SHA512
ba0f03aed6bc69a6986b2aa3e8be614fa3834a3251a138b56b1a61a2ac7f4905f0ab3b7997bc310c77d2038e2a2ff24254f7883841d0f32d3d83281f4768ccff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
234KB

MD5
b103aa0b92365c317afc58726b4c6e0b

SHA1
d116c8d92a9120528e9b924bd4052e4574fe00af

SHA256
02c91db2ae55cfbac36dedf57da05364f8455f1d45f218ee76adbb6299a5b367

SHA512
0520e44ca902cd1e9da95e935c3e4885d3cee0c528b5d9e76512bf6a2222707a0bb2e120d3018359a6899899c19dc771dcba45a62f97264ce259fd655cb0d936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
115KB

MD5
ce6bda6643b662a41b9fb570bdf72f83

SHA1
87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8

SHA256
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

SHA512
8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
2caf8e4c2da6b740ba6cdc319f423d13

SHA1
2dffa5e7f9b0ed48d985d7aeacee6860c3ca50be

SHA256
3de16ff8ac13878addbdcb72433781429b54aff6f25a8bd09d422f596ecfd9db

SHA512
b0770ff6ecaee0d00974cc192531efe4501b21a8f31ff65917ffa4264a908a34300dccac42d83bbe6f5762446be3b93c1512e6624f4a73ad4450498a811a3e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
13985a0cdf1424b0b6e369d08c0aad75

SHA1
23597ac65d40e413f892d669b3c4e081a5116acf

SHA256
4c77259184162187875647e73ae05ceb9d4e3f4d08edb6ebe3de39f2ffe3d6ca

SHA512
8a80aa15d3ae056da937a845dfdcf4e6a6ce7bf4d269acbe23c1472eef113dc40c7fb80f20af9f5773470eea3b0eebfd3091475cda083d02ba6196ee85f353be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
e33aa21fd78add23ac5d44b64dd0a6c6

SHA1
e95598e88bd11378a0756e4dae5e42119896888c

SHA256
69516a39cee8169f6c87d17c143c9b0a2e991cc7e91dcc454f33e86724d30f76

SHA512
a8ec08e0dd3f9fec6fde09004f44ab66de7b646c83ac0849ddac11439d3420ba6cd00462158e56e752fc574fdefe03ef28d179290cf5dd2cef55fa1792a1835e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5e14572b27d6622d3c55c6c978b1bcf6

SHA1
ffab2fd02d057af3be07e2085243fe5a13b5dfad

SHA256
bb5cfc2fe40e9c3d940a62c70638c2b354f01e0bdd220e9220d42acb20b9532e

SHA512
d3ba75876d955bfabb60fc8981f48fea521d6f862c074097e4b08f1eda136e89e2620ab1fef19c5338823f6c1aa2f34cd15b6b671282b20c5d10fe7c8d83fd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0a2ab7c7fbb27e1b2dbf6c11dc9b3583

SHA1
1b53a4724d17ebeb4d8fc56cf8334b0931e4870e

SHA256
d24172d0ebabb1473a4288cceb912396d23cbb5e550ff70a698fc7bb08665071

SHA512
7a5797365d7e8ee18ecfa8cb65f9cfc71e6aecec21da807c29ac64ef1d3b04ae388dab41c20129d788259374e65dcd603b4a6b580194715a339f55b3bed36d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c420a633ef8b8c03e5eea6331b4c1b9f

SHA1
574a68b290b9ec68e328337f4dc20bc91a63c233

SHA256
ea3ccde4f49d28c7fcdad7fc7484fac63ecfaf5b93512e64769634018a2f5a90

SHA512
b4f7ece255298b22cf0e8afcdec4d90516fbe44562f98e2eaaaf053dc9f31bd474d97efb1d5c64cd2791bdd5a395c438988db8bf79e44bf0024c798ecc6e3f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b00d899dc4867dbf27d3138817359271

SHA1
a6b9a410a84e37adfa557bbb0226e8bd796c97fd

SHA256
0b1341481553c591c5bfa057df3452dd0425e59d4a7e67551e6d4ac02450b96c

SHA512
9cce71217ffc32f950c3a7fe998380fc0ae252e87fa00942334ef29389214a21e9b8ff667bbf34021af6d494300fd570cc3887d0db5e6790557c12bc2efd5858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
75352ba08904c0a3d55b3c0d7e842673

SHA1
2755fc3d7d159eabf53c8d509616610542947e3f

SHA256
54b76901430b7bb98a4c60b1eef514fa007f12a7ac0aef904d01ff6874304588

SHA512
6c5e0a756870d2db2ebeb96ab8497ab01f2aa453dffc8915116feaf9b018af57f845f8c86771dea89a9d187e0b26337f9a63ef3ccbf68a42f339dac813a6b652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
060d6e8bf3cdc9ff6f94d225f29a8154

SHA1
d68e797f3cfd17afb887ce460a395c8df51a28be

SHA256
d710c99fb56903ce1051b6b7c25f4c9a72b32cdf1a0461994bcd1e3de44a49b7

SHA512
524724c80eefde6b53b4e25b87b47087f57738d95735dc06a41d2f7e3e83bdee50d1134f5d7eb8263adad6d1c2e2790cd6ef25383e9c374d5bceb10f7a4fbcdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
448d0f69dc7d0d2c85ce74b222b96a91

SHA1
0a8948e6f125574b5e50b1d47d318a4f9f3badc2

SHA256
6bb94fe96910086fd33e439d689426843ec9bba02f18141fe654b83fe2d05c5a

SHA512
e1edd36238086bdeea91114354240c4e8b1ed46e9f2fc8054c7c173054a428f7421d9f3d217c8f895a9e56492ad0a90c79409fef3f9bb430e39b9f3c1b7f286e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d664ddccdaa09eaa6a13edd27c8d4ca3

SHA1
09ffe08801ca8284bdc57fcd0ee58e2d8b7eef4a

SHA256
4a15ec2d1c05310e3e2a6a45cdf25092cd5a6fef55240884f9dda0922020aa84

SHA512
8ed8c59560505d605cd7a4177f046c577ef923c03209dff54fb762efb8d39327d0ae9fe2461d77e83337cf40e48926a1bbba925874ce0f7f8618efe4ce69cbef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c960140614a35d45892f38c0de1bedef

SHA1
bf9417166615a4806c8f48a00a5ac31a0881fc60

SHA256
e10e3151e4f813e55d1895e04bc61dc9add2f34e480b2da81f74ad90ee2bba1d

SHA512
ed8e62cccf64ba7fb2470bdfccab3803fad1f2eb98378231bcdff2de6815817538ec8a6f80274a725a1e01c1889b3ba9712d0bd1f149a3ef7761fad7b30ba076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7db95383f6fdd74ab634afe96d3e076

SHA1
7bd5a7b0f14c26e84684ff8d7374d469727456ef

SHA256
a24058a1508740fe2f4927fbdef3e6c3757aa3e6f8b97e85a2c6a2aaa40f6330

SHA512
7fc32ef7edf32a91eb2dab3492e7a0870620406cc3b7e61d4c435acfe8651c5dc80dac5d87ac35afae515469a0b099f2ee205cf36c7e1ac7b0e7c2c2457e99ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
41a6510f72b4f6d347f78ecebfaa8766

SHA1
f626ae74391501bf6cb499e4dbbb0ad8923e3ebf

SHA256
598bb01ca4e9e147871e73aa7d0551de11246e1806a22b8bd9ed1814f45cfccc

SHA512
bf461374ad8a3f9e324cc86975898e3bbd9fbc22cd8ec1a24449c8797031abcf8572fa811f6f65b55db3a0a3352752e29c181e98aafae5bfdbd630a1315b35ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
726333fe4ef82c5065da3f55178f5487

SHA1
1f4935766654c8fcf847916e9106e4aa227c3a4a

SHA256
62b9fa32d3b8e77b07452c166412285023343125efee3373c113437d7a0649fd

SHA512
87ecbb44b2563b8b45d64cfd4c6603f78413eb8f46e8dcf64b68f10e571ee85c36416ac4813060eb65c1f2a27cb061f1136448b8a499cc12aa47fc2a61fbbeff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a72d0.TMP

Filesize
367B

MD5
93507962418593a6f07a3adb6a816e1b

SHA1
ee144acf71f83e40dc64dc3fd68d1ba2a23b267c

SHA256
155b670a3c0fcebe3fc7040dbc07d02452e7a57091b82acedb7cb42dfddd73d9

SHA512
8a5a2f63f0af585f90f0449e4d49e0880ae46e767e65e886de2a2e1211943da51815b09bae3f28af312a7b0a5394fd7526ce1d6ef0182618c20bb51673177b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dba8f1b60e14d61859afa6779bcfd598

SHA1
5aca6a9f35d9ce7cc2961bd3b82c31fa33eb2a89

SHA256
d887aec237ee7b8b89d52f1d6b7c2c0dee68de6302bb54641bcac90185e54161

SHA512
2d59358c0817b0fd1f30f7fd5099549173a57ea029a700ff584e6fc5acde8bd220339018d12eb4fd0e3eae4c6252c8509e13f38886184ac6a9340282ed400c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9a172fc8e66cc3273810c0c197db77f9

SHA1
23df2fa9863261ba1d2509ce8f80fc819f138b42

SHA256
19051ee6ef77e8abc4a6ab29dd644fa47d07c9c2dc78f5beca0946c8a6d99018

SHA512
6dbb935d70c29dd0cafb93f5e394bf973242173f2805a6d1fa4b41ce4098bacdc3076e00dd8febd234b52cec5199a8befa5736dadafaee8a4ae0e41f77a5fbdd

Download Submit
\??\pipe\LOCAL\crashpad_4820_SAPJUYBLGHQHEXPH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit