stormkitty | 0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe
Size

842KB
MD5

b11247d5947ca817a59f2bce4a2565e3
SHA1

6c664f1d47a41b02fd3a83a721995833b03f25c1
SHA256

0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534
SHA512

fab4b1920682eb4cd33f60fc7c6ac823d65a0103483f5ed5db8bacd5f713b4ea6f256671c03a20617e77c4ca9abd2e7a2e6ff09a2651b8b206039cd18ea8a2cd
SSDEEP

24576:zq9FZgv6K89zwCgGofKP0fHxwa01vRrSNKFkXi4:oFZgS9O3SPxa01vRrSNNXi4

Score

10^/10

stormkitty discovery stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023c58-5.dat	family_stormkitty

Stormkitty family
stormkitty

Executes dropped EXE 3 IoCs

pid	Process
4168	svchost‌.exe
4168	svchost‌.exe
428	svchost‌.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\svchost‌.exe	0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe
File opened for modification	C:\Windows\System32\svchost‌.exe	0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost‌.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost‌.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost‌.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
4796	msedge.exe
4796	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 804	2772	0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe	82
PID 2772 wrote to memory of 804	2772	0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe	82
PID 4168 wrote to memory of 4796	4168	svchost‌.exe	90
PID 4168 wrote to memory of 4796	4168	svchost‌.exe	90
PID 4796 wrote to memory of 1416	4796	msedge.exe	91
PID 4796 wrote to memory of 1416	4796	msedge.exe	91
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 1040	4796	msedge.exe	92
PID 4796 wrote to memory of 2264	4796	msedge.exe	93
PID 4796 wrote to memory of 2264	4796	msedge.exe	93
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94
PID 4796 wrote to memory of 4580	4796	msedge.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe
"C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /run /TN Update
  2⤵
  PID:804

C:\Windows\System32\svchost‌.exe
C:\Windows\System32\svchost‌.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2436 /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
    3⤵
    PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718
    3⤵
    PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\svchost‌.exe
C:\Windows\System32\svchost‌.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718
    3⤵
    PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718
    3⤵
    PID:2668

C:\Windows\System32\svchost‌.exe
C:\Windows\System32\svchost‌.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718
    3⤵
    PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718
    3⤵
    PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80f97050-4eca-4a42-a404-366712ffb481.tmp

Filesize
371B

MD5
e24e23dc8478c944482dd12c65db8a3c

SHA1
088833fe07b25885979aa059fd8ed9ad31501162

SHA256
47b1e18186b22d6ad095bd430db428995c11e3099123ac282d33b1a44a055210

SHA512
58538adf5cad75f9ee5e492b7036673b84f42c1f308083dc966cd76ce7be86a2b78b230421c403960906fb1374f815a8709132c6d9a71bf0b975d9c4f09f3830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
89KB

MD5
6c66566329b8f1f2a69392a74e726d4c

SHA1
7609ceb7d28c601a8d7279c8b5921742a64d28ce

SHA256
f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6

SHA512
aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
68KB

MD5
32fe5c41c8be4730533b24849eb992d4

SHA1
a7c6fb7380ab8ba18a92ce65709bb44373770d3d

SHA256
174e2b276c85066c277f923bcd1bfc085c0b3a836e1e4eab5fbafd5c9b804411

SHA512
ba15cb8c63de949ff41b2fa0cbe6a073ee3f446d820fa49364f449b342e0f8ae58868c141f155734855c7679f5d9038e6935b513f782d8e073df84a58be81436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
487KB

MD5
831a0aa25af2c60a7380ea75c321d930

SHA1
140ec306c24ab6f348c4dde5900b219d817e2026

SHA256
8cdde5daa52335c0a4e416f6fc22aa80744207a38fc276bd65341c2d2e903557

SHA512
0147937b2b2cf9bbf7e8dbee2d598e156c6ce4ddff224b3dc48caed96e89038ecdff1ace743b82fdf6155c40b674f4b1983693dbe45c39898487d3b7be258161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
4d0bfea9ebda0657cee433600ed087b6

SHA1
f13c690b170d5ba6be45dedc576776ca79718d98

SHA256
67e7d8e61b9984289b6f3f476bbeb6ceb955bec823243263cf1ee57d7db7ae9a

SHA512
9136adec32f1d29a72a486b4604309aa8f9611663fa1e8d49079b67260b2b09cefdc3852cf5c08ca9f5d8ea718a16dbd8d8120ac3164b0d1519d8ef8a19e4ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
259KB

MD5
34504ed4414852e907ecc19528c2a9f0

SHA1
0694ca8841b146adcaf21c84dedc1b14e0a70646

SHA256
c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

SHA512
173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
32KB

MD5
6e78ee324e008296108bfcdecd77e318

SHA1
f7c39ee02c65bceb2c66ad2d7f45523feb5ad156

SHA256
eb7a4ff0f8ed4c8a95b2183968b5a59f4058b177f580ae2d2bef4595b6f6e092

SHA512
bcfff936bcc46ab4120690cff3af93491080e13084ea2bcd8bce1a2470ea86eb007d695aef23b73e0b84cb3c7fbf351d025be47ec5d232ab613a420074f8a448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

Filesize
272B

MD5
3579d3f8bd39c4fe9b8d9b9f8e02b3c9

SHA1
2e9c6b6549047d9cfffeb53f6f6ae41e2970c3b5

SHA256
6bdcebbeabd18c18f07543c903ae4d15fbd71fb4fb34052c7e44ae6c8e85337f

SHA512
fde4a4b3a0aa8922f8f936dc3c2931db500c9a96fb6690956f6c7e00365dac46a464a7221669c18d81c62e3c4927d6b3feddbe7b7eceabcc0b92e83069d63d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\43b9955e472b7d28_0

Filesize
188KB

MD5
a4f78d3192bf3acee7c2fd4fcc190fa1

SHA1
dee59aa2ff7845e9a4e9bce1a03f2fa255d60279

SHA256
b730e8bc834057a6cac060099b6c7bcbfff814a60731c3165de6591256385b3e

SHA512
4cf33443347edf343e8a74ab5725e5be9e1985f73512c90f8532f6300199d3327b7633cbc0dbfd05b721a0ce95c101b1312058da2886fa5b000f1ec307deb316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

Filesize
291B

MD5
b65814dc90ba16fef77968bb1990ff41

SHA1
e418c377b77f5adfbd815c5224c7d40a1e7fc53d

SHA256
50354c96a1d64ed155eeb509d0f9afa1cccbc05b6e6e9d6f52572b8deaedfd31

SHA512
ceb12fff7baf5d08ffc49725a2a65ae598b44b7fb3674c1c8565869ff20446ad187190a786afb2d213a879d8ed1d1610bda283030c98b41daeff8184b0313666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b27b4e0687c2dc36_0

Filesize
295KB

MD5
e941be0b55681c4760b90ffa679225d3

SHA1
d486d48af8a8e9d02b5b913b336ee383a46469d8

SHA256
e5ddbb01860d275e9e60cd4eefde12d1295037d4f6ed5f702f306e2f19c52082

SHA512
68ff800ef053b1187fa5a86a4444029879039d937f7cbbca224f3d8ee2c03977ce34c665793ce648ada6a7076ff2ce21ca608b6e5eacd9345726d397bd28b162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bb04b1f98935d973_0

Filesize
1.3MB

MD5
1647d429a83b10d0c4507ac6aa6f116b

SHA1
315d5cdd5a3f5f4b02c4ca8075a4b9511d2f3fa3

SHA256
63900ed02f4e0a6e8b36d68d4c3b892e60291a0b0dd344adb16b5446be6245f4

SHA512
67da7112acbf2022d2344839e236d4682116d400b9b3f2b569895473cc5eddf9fcdba64b558be4076d9a5155a7b0d1aa6aa2c84c757a132d6c67a823661c5484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bbe72cd5e3070892_0

Filesize
1.2MB

MD5
5f3876edf67350bde1e4b6ffd570d22d

SHA1
be3f6ab1b275766792f93d9206b771695ae448d0

SHA256
ceb39b956834938f375200073725456d50095a56750cb6d6888c08d57b548df9

SHA512
c6fc3fc773f2a7e06d7a7d3faeeca59ecd57afd4f3a73a7967a3791fbe2d73768d41bf8c8ad9b5aca218dafdc1a2edab757ed8c3b9d0394e8e45b277466db44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd170a2f734f322f_0

Filesize
1KB

MD5
5387766805516aec752593e360ffa122

SHA1
d3a98685205a604072251f57ffc1ca6d62505e66

SHA256
0da5d9a5686877e8c21fd1e682ba527b0086b41118f39ab125814636ff6304b5

SHA512
924f9b0493fdc5e9bae551870486e059faf25df3ea98820d7e600944c723a4c7b8d7414e9c68d5d4201a1d4dec89cc95b6ddff4a41e53ba514479fa182777b72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e20d92deda6cb352_0

Filesize
297B

MD5
3ee2b5caaa93e680202cfa11ca280012

SHA1
8c5b774b1ea0f39155ab98b09351b6e6eff5dba9

SHA256
c3779832fef460e8dcebf16f72f9f4296ec8496afbaf47fc6c1f18a0276656ed

SHA512
2fc3a80039bd57d8172a0e7f9ff654a3b68bafee43217cdd2fe0eb46116f90f991ad25f3fcb7ab941c342ad7d5929da5499741c78f01ea04189de210af54db2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

Filesize
269B

MD5
ad4f9cf3db6fa96ecd02f32ad4730215

SHA1
9e114d8c050aa7ad54f3dcd222679ab1ba79d68d

SHA256
b702a7be868e439f738efe539dc6983799bb940a6ac1c2430e77283af63313b0

SHA512
6814e26917cd41d62d57b5a63d7e0114bb16c7b0d96fcbced6933a273715d0e87855d9cb3dc9d3bfe26d661edf27780775866deb417a546881fea2ece50e3477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
fb2bccf4d5da3ed2c06b61e935b0bbe3

SHA1
9f03348e0278eb832febaa992f344274e5c05d19

SHA256
fb55d04242680362aaf1ff5039badd2cf33d7cd5af09a5ac6583cd97f0808fb2

SHA512
889af3594b84a3b76e6f1121ea091900d624dc8d314ba79e55cc9797b02b1ffb3a37e6a8c7bf357d9b4687ab9771a4572119696fb918a1eb1e6dda38b5810f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d6c93150f9b571524e271d282fc2cd8a

SHA1
1e69715f7ef68a2b08ab50a535d919ac2f914aca

SHA256
2eb939a623f3e99d98d8f76e75e797071e0e5e73cadb7d6a39bc6dd624958b46

SHA512
a38acbc3628d84b645790e3720f89f01fd79d8d9c4f778696b679b87044e5d83021e138caa271c7fcb12ffad6e6ca9e7e50ebb10d5649c6891cfa8bf44398f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b2428f288d326d08599a716f3590fe2

SHA1
c9c6a10e025bc95ff4be20baf43c384ef3634560

SHA256
9b7a7d21bf66947fffa6180cc869b27ab401e97aa2db3c8debde6a79f62bc9c8

SHA512
b50ec2a23044dcfbd5e720eedd0fda6609f56ad304b8944f49dd58170008cadd8d2bd45fc8bdd6dc4432e4db1f7f93fcdbff7622ca19773ce84a0952f82c8c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f4be548fb0d61d64e5b3508d99c5c09

SHA1
7fbf800e49360d0a2feb700d9b6cfbb3334e93ad

SHA256
3ec3fa42a41d11b7a8e565284489b49bad6dab79ea3549f6ee2676a79d6365ec

SHA512
8627e08c0549935e737fd8b7abd8a2d810821cc81f316cc1cba284914be2bc79a151f88c74d497c0d8bf21792164f3613d6141d233563871a767131e8a8aa2bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5b65724868b8a45fb03499db39da11f

SHA1
20287a1e0cae6adca72c8aa7fecfbd5b8b821c90

SHA256
8f1549907bc2616c6dabcb95c5c49144768b3501f26127efc30a60f0a7879d9a

SHA512
60b2d6bcbd74dec0e17c205a5b09321b9c7c0b95da5ac36930ef777a474e7ec5a548a8e285cb5fe2fa28555b845e5b1d375ce80f18fc4ff733f32c40bb74a90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b99e264386c3f8aefad11ab6e1c648da

SHA1
4bfb3047ed255a5226d4e9dff2e5e9fbb17bbedc

SHA256
9dd2f542c83992bbb8abeba0bb20b1d0c352afbfda95b32780535960a4c06610

SHA512
6cf70244edef00632c0c5edaac9994bc6d8861d58d350428d19780c5338cb08cd67794469714f90ae4aee1ae4712c836e20859100856dd09259c7471dca42b6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4c64e14144eb829954ba351ccd8cb463

SHA1
794412acfe7db10c5ed45738c7f2955cde694d6a

SHA256
b12fdc44e70912de5c5e107f28ebdd9eea4c88ec9752f9bef127e3781414b4f6

SHA512
20199614d4839810d27056928cf297e41afb5da541bd5c8c5a58c6bbc81e94f488d2fd0d34d1b8dd3b753f9b3ce545efab2f0cd4af1666ee2065c80d337b294f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d973.TMP

Filesize
371B

MD5
cd7d8fce4ca2f229a0958b0ec4b49221

SHA1
de8f7f66b7e205e040bd6c44ebee0fd90fbba2d1

SHA256
997032e243e4dfd08f8de3f72ec3b85cbc98a6917753be40169723ba01f3e5f5

SHA512
56faea4d0aadaf0c4924b9f1d57059638d6fa0dd70479981cb25022146979e7cb39229a715d62b341575416f98aeb07acc81aeee6a3b95753d768ee3d8dcecdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c7eaf4acc6c1f871ea494272b1b0ba1b

SHA1
78b4090086e9c2b66f6ac02155c003297a9cd43f

SHA256
bd1e63fb4ba12a2b8aa9037051a6141581e6c4ee4648287f9df95e84bf69a836

SHA512
23067037a7cc72aa860f64ee304e632a040c87c5e14ea8f7fe209ab208acc1580dbc1a0d8698539d354024cd0127781732ff29a66cec271ba6347a057502fcf2

Download Submit
C:\Windows\System32\svchost‌.exe

Filesize
660KB

MD5
3ae4a965680a6b9572c238cb51cd0f33

SHA1
850b303af5b5818c8c34cd88ce67acc6f093c248

SHA256
51f1e33f84709ac4ff359e47fc0c98395cdb12bd70feb8af78e40f494ef9803e

SHA512
328cafddc052b566033bba0e5714c0dbc53e7c442500969a1a556e9fb90d97fb9efccf233ac4632d148b2d6350c54a0e5a8c6d4be5b19b1dcba04b0a61e17bb5

Download Submit
memory/2772-1-0x0000000000340000-0x0000000000418000-memory.dmp

Filesize
864KB

Download
memory/2772-0-0x00007FF8221A3000-0x00007FF8221A5000-memory.dmp

Filesize
8KB

Download