38cc638bca40c2a4834c48c2e77c47c5a5e40c2ac9414b620babf079e87c27e8

Analysis

max time kernel
481s
max time network
463s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Help.vbs
Size

418B
MD5

4dd7ec5063da4cc0df8a7227e90c26ae
SHA1

a8d2447a647ee235ead4e873ce3a6cdb140fada7
SHA256

38cc638bca40c2a4834c48c2e77c47c5a5e40c2ac9414b620babf079e87c27e8
SHA512

c8e123542b5bca4aa9fa46ef540601762b0ef6af65dc5a241298ae2b626365484edfa1e013940265abb9b7afaa1c6ab70338ebd1b31fd87fa10ef39053ed1ff8

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\mDns	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters\PortKeywords	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters\PortKeywords\mDns	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 54 IoCs

Processes:

dwm.exedwm.exeLogonUI.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "186"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Modifies registry class 1 IoCs

Processes:

MiniSearchHost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exetaskmgr.exemsedge.exe

pid	process
3368	msedge.exe
3368	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3148	msedge.exe
3148	msedge.exe
4416	identity_helper.exe
4416	identity_helper.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

4428 taskmgr.exe

pid	process
4428	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

Processes:

pid	process
1392
2140
1148
2032
1688
3936
3092
4356
4416
2768
1060
3580
4984
2776
1488
4932
2724
3376
3328
2480
2752
3584
4444
2900
940
584
4192
2688
4900
5052
1168
2852
3628
4260
412
2352
2404
2736
2932
3048
2428
3656
2796
3404
4572
1116
1256
1268
1232
1356
1592
3732
1200
1864
460
72
4744
3124
4684
3600
3748
4496
2600
660

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

taskmgr.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	4428	taskmgr.exe
Token: SeSystemProfilePrivilege	4428	taskmgr.exe
Token: SeCreateGlobalPrivilege	4428	taskmgr.exe
Token: SeCreateGlobalPrivilege	960	dwm.exe
Token: SeChangeNotifyPrivilege	960	dwm.exe
Token: 33	960	dwm.exe
Token: SeIncBasePriorityPrivilege	960	dwm.exe
Token: SeCreateGlobalPrivilege	1536	dwm.exe
Token: SeChangeNotifyPrivilege	1536	dwm.exe
Token: 33	1536	dwm.exe
Token: SeIncBasePriorityPrivilege	1536	dwm.exe
Token: SeCreateGlobalPrivilege	2044	dwm.exe
Token: SeChangeNotifyPrivilege	2044	dwm.exe
Token: 33	2044	dwm.exe
Token: SeIncBasePriorityPrivilege	2044	dwm.exe
Token: SeCreateGlobalPrivilege	1512	dwm.exe
Token: SeChangeNotifyPrivilege	1512	dwm.exe
Token: 33	1512	dwm.exe
Token: SeIncBasePriorityPrivilege	1512	dwm.exe
Token: SeCreateGlobalPrivilege	2748	dwm.exe
Token: SeChangeNotifyPrivilege	2748	dwm.exe
Token: 33	2748	dwm.exe
Token: SeIncBasePriorityPrivilege	2748	dwm.exe
Token: SeCreateGlobalPrivilege	784	dwm.exe
Token: SeChangeNotifyPrivilege	784	dwm.exe
Token: 33	784	dwm.exe
Token: SeIncBasePriorityPrivilege	784	dwm.exe
Token: SeCreateGlobalPrivilege	4876	dwm.exe
Token: SeChangeNotifyPrivilege	4876	dwm.exe
Token: 33	4876	dwm.exe
Token: SeIncBasePriorityPrivilege	4876	dwm.exe
Token: SeCreateGlobalPrivilege	1440	dwm.exe
Token: SeChangeNotifyPrivilege	1440	dwm.exe
Token: 33	1440	dwm.exe
Token: SeIncBasePriorityPrivilege	1440	dwm.exe
Token: 33	1608	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1608	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe
4428	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MiniSearchHost.exeLogonUI.exe

pid process

4220 MiniSearchHost.exe
2452 LogonUI.exe

pid	process
4220	MiniSearchHost.exe
2452	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3764 wrote to memory of 1560	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 1560	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 2836	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 3368	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 3368	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe
PID 3764 wrote to memory of 5012	3764	msedge.exe	msedge.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Help.vbs"
1⤵
PID:4540

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff87fc03cb8,0x7ff87fc03cc8,0x7ff87fc03cd8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,17273920927193727914,13456618544178305638,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Modifies security service
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2136

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39e9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2452

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b3a286fa28c9926d8c88620ea823d6f2

SHA1
60fe6132d03eef384b6c7eaf515915c95d914fbf

SHA256
f8524f67c3563ab10b0049b22a569b0793c0ca379989337b343760a6a5878051

SHA512
798a504459d7f685bde23e977f2ef6a7bc8b30fa212302bc1f8c93681834831589f06471bbc8ffb4794b294e029ee71aad1cfb6da5c14a82131126e8989fb107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
857B

MD5
a72b4d2a0666903ae3a88c4d8c61a76e

SHA1
d0d92d963e472a3345fac94a44814ac6dd25f8d0

SHA256
76c82f8d2fac5f3dc52fb964a6e67f8b350b68b2eb7bb34223e2d4300ab60c7b

SHA512
97f456c48226dd1cf11da86979d3466854a9246a9ec0a8ee8d09937d662a8a73f6671fb6fab7e0d1d7bf98d90c2ce23b1bd5f292255fc9f66b2ffacd069a8df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12b49b18301e30431181de48f152620f

SHA1
be4bfe29a0618bc92266c1a6b81260f3d5ca2cde

SHA256
a228321c7572f12118619cb8604790e93b53432d270cf42430e1a36d89f04725

SHA512
06dd7f97518eb20fd8b11bbec87bb7ddf37955cb1ef448ac468b30d7c1161adb8d784766a801268d84104686bfb9bfcb0d94524985eb944deeac7237a1bfe4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aa859820f9075fd98c04bc5bf11fabbf

SHA1
c62efc74de4da342cd58bcd1db7a4a91ab5fb290

SHA256
9078be0e2261e4c3fe410fff644098a0ddcdd7a3963b2dbf04b57b7350ebb776

SHA512
56fc3bfad707e30924320e6361fcb258d814a8c956d55d5e8ed5c2cfdf2be90888227c5c61da54bd240711dd78e039d1989de5d8cc8ab047375d666e9f3018b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3978d973c52c9423695328596c970487

SHA1
a47a15c9d393784fb9fd49bfa9f82b82dee65d6f

SHA256
ef254ce8d068b6a401da302c344dc7adcb80c1a4b3b364d2de6c47378db118be

SHA512
161dc7e0bed24e6edad00dc17fe87d688be87ea1a22407b63fab542fe90ae241b9a9af626403925d1c5458dc5dd51ba63e7d236fc5b06d593d96d23879cf7d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bfb3ad390ae25d94b5fe53d861154e5f

SHA1
57d8009430bdb0f53e4d5e46892921401d98054a

SHA256
a886046d866b14728d389896a2086e71376fcc5d7cc19954f85b0529f77a8024

SHA512
ef02d8e3180c12e0bfe84e6102a4e3dca421d21a375e3c48a51fa3db879010f318926031ddf0c0c13319916b8d6911d070ee1b3c397ef775ef06f4446cf6ecb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
590d8e12da435d858553db1deea4b0e4

SHA1
6c01836fa0a2e26fe8851e58e762d6cffb946492

SHA256
d9fd52933549521dc2a38e3467f2a2ea97f38a2571bf5ad08594fc134ccdf609

SHA512
28980e3b5ea258845377102a405e2767b27d03e5bc4bdae23c1ee1d0491e2d16879dd596224fedfa3d53a0ab96e0ce2f2c067786f0ca7529276661558bf591a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d786428d784334996ae81fa4aae2128

SHA1
e4a72bc6f6d43874d6c82b4fbe645d04c1fd7d59

SHA256
3d5337a562021a1701f7ddf2dc51e64cce8f22c4014d83bc5e5b50eba687e8f8

SHA512
d992ebcc9877b4dc26d7ad101e357dc9bba26793a018f3cbbc8c6ff7a3c448e62b3f4f425998f6cc718ef5aec220d6525b5d6b127a336c5abbb7e2e6da41bbde

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
96329c73cc49cd960e2485210d01c4d2

SHA1
a496b98ad2f2bbf26687b5b7794a26aa4470148e

SHA256
4c159cab6c9ef5ff39e6141b0ccb5b8c6251a3d637520609dfbdd852fa94d466

SHA512
e98736a879cad24c693d6c5939654b2fd25bf9d348f738668624214f22d541a9b781c967201ab2d43cbac9207946824a0299d482485f4b63c48d5d2a839e5baf

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
847a64ce22adca83e091e5403ef844ed

SHA1
f2cf8559f0eba3d237cee1162b811613d2a0c308

SHA256
1db255895b125edbed50b5296edafaf303dde2b93a600313b6a1aa61f9ec2b88

SHA512
94abff56e498bfd7af0e72a652a0b03d29cbe7d0322f43cb8fa4182cfa829ec6d608c5bb3f6deaaf1dcaae764c90036beedb503109c8080999dfaf2d6a2e9de6

Download Submit
\??\pipe\LOCAL\crashpad_3764_GFGYWBYZNEAAQQIM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4428-379-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-369-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-380-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-370-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-378-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-377-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-376-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-375-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-374-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download
memory/4428-368-0x000001C588BC0000-0x000001C588BC1000-memory.dmp

Filesize
4KB

Download