Malware Analysis Report

2025-01-03 06:23

Sample ID 241122-2p3c6a1nct
Target 0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe
SHA256 0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534
Tags
stormkitty discovery stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534

Threat Level: Known bad

The file 0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe was found to be: Known bad.

Malicious Activity Summary

stormkitty discovery stealer

StormKitty

Stormkitty family

StormKitty payload

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Task Scheduler COM API

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-22 22:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-22 22:46

Reported

2024-11-22 22:48

Platform

win7-20240708-en

Max time kernel

134s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe"

Signatures

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\svchost‌.exe N/A
N/A N/A C:\Windows\System32\svchost‌.exe N/A
N/A N/A C:\Windows\System32\svchost‌.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\svchost‌.exe C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe N/A
File opened for modification C:\Windows\System32\svchost‌.exe C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\System32\svchost‌.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\System32\svchost‌.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\System32\svchost‌.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A087DE1-A923-11EF-80FE-5E235017FF15} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097895bfaca6d6d4bb4fca0d16b686dd900000000020000000000106600000001000020000000c1e0e76d326ad0c723be757c151030626ec6ede2d5f780b0b53915378287e4c6000000000e80000000020000200000000bd9397d94d09a07ddeaaca440b193e09f45f37554223f93c0121015748cd93e2000000002c2be9f2c634485b0da4e7096f737d63d0a6568d161e6e37cfaa796f102caf9400000008d93761031899167d0398b4824152b786b5b179956625d9796d6284040c487512aa341841c7dfe21bd748765aea3c57e88db6b2a3c0be152ba0cac0738350513 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438477452" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097895bfaca6d6d4bb4fca0d16b686dd9000000000200000000001066000000010000200000007fd7ffa88d8a1d01e9dad73f6a143160529b5bf3ae1cc622e622499f45f89c05000000000e8000000002000020000000a1ba4dc7af6f146ba833368e5ccbe1b1a5c1b6808e9c6503bc22873488a6db9d9000000054a6abb4e679d6688b9d950f0db1799b192fa96705e396a9d82cdc9eaf6c20088e7293dca69f0cee23cad448d30f5e744efe07a3e77b671b4e66558b9aa9f30cf0991c7a1e874fcb7a9a9034d4b4250340aa6a4629c628e1fe7f10a4cbe93f19b2696ac4a8357fef91e5c5181f444041e327e102ed5a95128f9b94e9f1c16792a73d79ea87251d294eceb938ac35730440000000a33717a87625e27a23506785015976173dad15dc6b5d498325bce3cb680c1a7876999cfe4ab9c4349c1eed2ac0bd3fea862c88d0ac1b440bc3523a3c2b7b3c73 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d083d671303ddb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2308 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe C:\Windows\system32\schtasks.exe
PID 2308 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe C:\Windows\system32\schtasks.exe
PID 2308 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe C:\Windows\system32\schtasks.exe
PID 2708 wrote to memory of 2768 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 2768 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 2768 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 2768 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2768 wrote to memory of 2580 N/A C:\Windows\System32\svchost‌.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2768 wrote to memory of 2580 N/A C:\Windows\System32\svchost‌.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2768 wrote to memory of 2580 N/A C:\Windows\System32\svchost‌.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2768 wrote to memory of 2580 N/A C:\Windows\System32\svchost‌.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2580 wrote to memory of 2608 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 2608 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 2608 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 2608 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2708 wrote to memory of 1756 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 1756 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 1756 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 1756 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2580 wrote to memory of 3008 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 3008 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 3008 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 3008 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2708 wrote to memory of 544 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 544 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 544 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2708 wrote to memory of 544 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost‌.exe
PID 2580 wrote to memory of 1548 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 1548 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 1548 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2580 wrote to memory of 1548 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe

"C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe"

C:\Windows\system32\schtasks.exe

schtasks /run /TN Update

C:\Windows\system32\taskeng.exe

taskeng.exe {B9997810-734E-4263-8B6B-6E06AFDB831A} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]

C:\Windows\System32\svchost‌.exe

C:\Windows\System32\svchost‌.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2

C:\Windows\System32\svchost‌.exe

C:\Windows\System32\svchost‌.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:406550 /prefetch:2

C:\Windows\System32\svchost‌.exe

C:\Windows\System32\svchost‌.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:472088 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 learn.microsoft.com udp
US 104.78.190.43:443 learn.microsoft.com tcp
US 104.78.190.43:443 learn.microsoft.com tcp
US 104.78.190.43:443 learn.microsoft.com tcp
US 8.8.8.8:53 learn.microsoft.com udp
US 104.78.190.43:443 learn.microsoft.com tcp
US 104.78.190.43:443 learn.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 learn.microsoft.com udp
DE 2.18.98.139:443 learn.microsoft.com tcp
DE 2.18.98.139:443 learn.microsoft.com tcp

Files

memory/2308-0-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

memory/2308-1-0x0000000000A40000-0x0000000000B18000-memory.dmp

C:\Windows\System32\svchost‌.exe

MD5 3ae4a965680a6b9572c238cb51cd0f33
SHA1 850b303af5b5818c8c34cd88ce67acc6f093c248
SHA256 51f1e33f84709ac4ff359e47fc0c98395cdb12bd70feb8af78e40f494ef9803e
SHA512 328cafddc052b566033bba0e5714c0dbc53e7c442500969a1a556e9fb90d97fb9efccf233ac4632d148b2d6350c54a0e5a8c6d4be5b19b1dcba04b0a61e17bb5

C:\Users\Admin\AppData\Local\Temp\Cab123A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar13B6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d2ce36c4f75cddfe474789113f5ebc0
SHA1 5ec64abb121e307b3dcb193e4335574bdb9edbfe
SHA256 48d7049dbf46c55b34a6b21209a12209eedd5f8610c3f257a44186906fbca04e
SHA512 0b8971e45e9013fb737ea8c108354b20160b45690c33d5176599766d49de70e7e02f50b567dadabef2c3185a1724d3dbb276c71e4746f3ac65d7c1762d8bb9e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4784b68870cec0aa1cc81a8fd23298cc
SHA1 6f508c09cd9010fb423eb9f65014e5bc6b7b61bd
SHA256 57ca53ac173f1753a0f07ba9d295df5f5e1985505a312c0921f393ea6a534d40
SHA512 213f90a029e0139a01b3a712a7a29f4cf0ff5bc1d1b651a484133c769d4c294fd9cbfb823d269697625ed2726d3ae6f36ace389ba330070192039504be445e5a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b0f505266b0ae37c9b3ed7746ce248d
SHA1 a87ec83b56eea850bf8bfd9628daf19b9412afce
SHA256 cca7892714a1cfc653be3729d5200fdc8b3d0189d118e2adceac4752b9b8e57e
SHA512 09366c11ea4fa4c543ae983d7e69c50fd314cc5bec1b7065301f3a076c68495f2c322440a3bc3ce4684b7311a262eddf896330caa7355c2fa27aa12bf07ca37d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e12df1c00208f3a6fe6a5ec38238d78
SHA1 00baf5ef3cbf6cd1dbc92f83ca6b0662f2344000
SHA256 5e33d3210777d44cb5093dfd0e463390ca513595c66f14dac769635e31eb55d4
SHA512 b1ee29324c54ffff8f7b530b9d9da3b93b2b562bc6696fca4270104c830e13b858f7b350ccf7d9e1c3e2289b2b12940370bd14f02f90312062fb5649f209df83

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

MD5 f55da450a5fb287e1e0f0dcc965756ca
SHA1 7e04de896a3e666d00e687d33ffad93be83d349e
SHA256 31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
SHA512 19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3c39061c11172de3378415cc1a32ea8
SHA1 94ed7aedea9cb046fe8d2f434d96f2df80e29fa0
SHA256 c5d82169ff5be2d689f558a3c9ef22a544aac6d6b4bbfef17ffc6aa0f61562b0
SHA512 9a9c93051be94628ada5a5c897cb2f06019459ada611c198dd4130571f24b0b7fca3ce4ad696e9964445d2f622d3bc1a399bd9979736a8a6da481fba63917df2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f86f16e471ed9136ba435c6a3ece35b
SHA1 2e762eb2fffd3d063e65727ee0d1889b54add0b8
SHA256 1457230a9f1bd254ee39494e22ed37ef04672eaf75769ff30b29e111d804ec98
SHA512 1fcce379ab9b6cdf2f2888fb5f8483b74cf300dce67bedf946d64cd2c5fad9611eb71806f7f56b3d732f23567742bedfc8023362d16f2f8d4d26dbf19731941f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e15b89bd079a98d9d63485ef5947232
SHA1 2d9568ad8f5a7230fe9c6958b987af1365bea859
SHA256 c2452bc679d17d78a75fb0af8cf3335c493e4d66316fb02552b7d46cb548b5f9
SHA512 9c8567e047ebcb4c0f4705977913bcdddf3664ba6838046b3aa213e945d29bef25dc139f9065ae764021576682ad09d753a414ad8fcad8eaba469f7817bb6e02

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

MD5 64bca2c50ee805f701283c117e0f0219
SHA1 d87c263e8977c7422b6acac87a1b2772e06f7f2a
SHA256 0db161691c0460e599b29d5d3139a283162d7a193b1e63f00ffaa5511c892dea
SHA512 a842515541c4efa80c1bb437aadb3f91e9963eaab26ae724fcd76d44828347937a5305210c790a42f9c4e294c86392e3a53ea51adf937adafb4d53e883d6f5c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13505196abb903a737f2e4cafd0d027c
SHA1 bb0801e1cbad7e6e3d612ea53ceff77f90d832f4
SHA256 2f5441490a7587cfe5afee900e0f29fb90cd942208f55e528977d81b620bcb9e
SHA512 22b79e23ced6b94e4168f4e43f62f1a290e95a2c49e549a961ac5ace19eaf94b7a97b7e2530184f9de2ef01132d6159fce79bc33c73a989065d1b853b7d4ba78

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ddaf966362201028f28963da25cd81e
SHA1 4a2bfe9d3a18fd6f28f60888b1f2c68a839b50a6
SHA256 d271f61d7e631ae15b594a4efdad220f76713196c45c9be8e5a44b62ae26b4f1
SHA512 43734c0c0582206c5da3bb616c02c7444984d0d10d07c638629896c2abe97bd10ea9c99a4400a4be9c1b3048fa9b65b056c4f7c15e802d50ea2863e02f44d1b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c5c17e6677f39ed0bc252300fc3e6721
SHA1 6e90f8c954e2c47cabfcfb1b91f03eb252c9a492
SHA256 421be0516bbfe36377cb08bfcdd12c3d9dcebde64aa3862ac63d78dd7e70512d
SHA512 fa48ac23598ab769362e09618db87e3c3318897bfd98d1444aa3c5a8e37e8bda670d58be33be4cc569efac691c4fb62c3c6c08f83f99fc65dce17e82c895ec32

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1020e3edddab65e186b3f5072e903dd9
SHA1 7fba94def52d23b2f90ae36d73315a00795975e1
SHA256 5a527b0d799dd040d01bcdd83f46d064ce9e5ee9bc0b04622df8fe95df2844ea
SHA512 ceb4cc6fc6cd263d601ed68194dd0cf857ecab5ae10d42862874c265910fdc7b64b5f7ade0e312f1c5daafa0d6deb63a63e1b521ef50dd91a286440bc1f6079d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 31efb647d9339a3f1c8417243533b254
SHA1 cc27ff9ad09c47d4ba17ad589a89baf59be2ca88
SHA256 8f6ff1f02a4c8ca00f01f0edcf327f154d24340d3de300f75fc46231aafdbe0b
SHA512 0e14b35fb89563239e2955242e50d5f22d73bbc9d55b29168a0c2433e04b0251a708852382681c324381f5af384bfae60043b892008ba17129482d8f9b40297d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b568000fcbc79cea297e25d0ab42114
SHA1 02e02b2cd142872a993928d07ac422ec6b5edb7e
SHA256 f6f41b392e165aeb8e2e64e90e07748ca988517d3ce5ae319ff42d67a219bba1
SHA512 481633da4686eaea0185aa36beadcb0f8e2de90caed5ded5206b58312ebe42483d3544c99a4d988f39d4ed0b026bfdd999a846f69e9a7be24103848880372d38

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ee76b0130586037733f6c2a64f80403
SHA1 8fa5ca48f5af15329a64ecb44c813876bb1dddf9
SHA256 d5261af8b2210ef678898a5553076d55b3cda352c6e2cf9eb0347c5821b0be9d
SHA512 c3dc47d9bf22147cdd18b076da9b993b3e9bba07c89c9be2da5b7774452eaa2af563e34f61390da3a641ca674a8f3bf2a3c522c34b2a743d4092ea389218ecec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54df676d10e0a77b554a9b189891b367
SHA1 a70463fe14a5364b297cf05a54a4a13575d8366a
SHA256 fbd08bcf315bf4a03e19fddcd93d0af0ca4f6554ff3f40423625f50bc2f67ac4
SHA512 9a89ab2b29d1533f2553c61932fcd6b0750d9507c06880a8bce5a90cfcc36a0a243b8aedf7f02836e2d192f88fea7bbfd76a0b443f77075d56193a00bd8febbb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 408a8b6a87ec857cd8aabab1451ab787
SHA1 eb544bd42889747dfc5b186c6a8850c78ac94465
SHA256 c64a5d9aaf0020c89e4245101a5196cc28d5c697e022c9ba998f0340b1431b15
SHA512 00506ec25d82ce5dafb089b7a25cf53abd51c5c276404f699d029003d4af63a0c8fa2a9a727552a2f1cb211cb411e17385e7936e899f1a9d2dc7facbca1d7a89

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d115bdc386c53d60d76fcdb3f0912577
SHA1 accd38b1067bdd057a61dd783bf61778f1b4e294
SHA256 d54cdbd825f3f1180428fbd8542714b4074b0db9391dc3e9f6acc5e710ce9473
SHA512 6675ccff5f6b6529df16240d83eb4f8f4181955c488b01a5cef1d0f6e114a6a51f3e14aa779eb34142d06ac5d35859c2592d3359069063ba0572a5b37621343e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 30b618ef2cd27151433f328129fec33c
SHA1 bed387962d49598ef77ad431e45dd3692f0ed084
SHA256 810621121e8602263642b7047adc4552ccb881b206295d6728a929933aeed908
SHA512 673b34985f4c7edbbe4f522ba95afaf51b84c531e1a50da907e7d4735f52c3ff4371cf83d564a7007c7f3216be9394fb6ed6f84448df4dbbcd0eca8ba7fcabed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a540f2302d43dc3f47b2bfeed67cb58a
SHA1 5c2783ae525841773e933b4659617158060b2182
SHA256 1c32677e0550cd0b850842f97381fd3c7014af76f4262ecbfdec871aeab47930
SHA512 a67bd44c113e14fef7f2002ffaffa2e7a96f16ce03a60a99512aec979ec503f90d7b30df2c612dae0c161e5a310201073ccba8fe67b506df21e208b12433f750

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cfbb15bcec713f8dff688ef488d88555
SHA1 6552e7f494f7c614c2c4d79d604129e1b7f66826
SHA256 e0f7e23881955a4a36e2bb2ba58aa60968995d8a399099bafb22e3e1ff25e266
SHA512 4a14c1c7eca31f87e2bf33a82da7fe69945628188ef733733cddd0698f0fec7e68197e51fca1a84caa8fe470cef811aff7ec4e401b09189eabbcaea21855ec7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b1a3e7dfbe44e388bbb8b300cb32c9e3
SHA1 1ee97691096ac5ff32f5335e4c45b4b61a74fcb9
SHA256 c5ff6dea8adb9f5cbab5d373ee7121fe6fd8836bed6fe8bcb2670dc93f852615
SHA512 bc6fbfe40ce05fcce22873121c8c365cc783adb14ebc687638cb722be3c5a0910cff9a235c036a337588c1d7806aca5f4cccfc3826306f285c474b7d3ee3e870

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80b094809695c7f5e6f34e19cafc3eed
SHA1 41e65404d8ad39f7c8fb983041525e800b2a0e79
SHA256 778b7c54398e0de87d846ce1f63def91ad379020921c12b543b26756f8b6906e
SHA512 5da7d357a4eb160490b2153de9ac44d6e09c516b0a9e80e3a77c94e139e4802fc5057e3fc8c9911d08f5c33473c8192be8d970f22977128db65fb2804ca799b2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d6387917babf6b32773d0a706c07891
SHA1 ecc5cfe3e0934e99485bb3a2395b0b0f69b3206b
SHA256 d7d90f10ad9c3b628806c86c6f6f944cbc9bec02d9209a8278d5cb189040206f
SHA512 1372420a10b119e4c9efab16b32c6b50044f1e90b9c0ca730f7c3d53bbc19d0a1cb4463f03c64d49a14e17da8978834a547ad815dab1275984ebf17bc376264e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 863e0fd8e6443d4fb6ae4dfd74be02d9
SHA1 ac2d1749814924ba1c601a0d76d6b4e67ac4817d
SHA256 8c6c20b1f3f12297c45d63ab8853c2d5ec2c16cf351bb53c6a3bff2e57d4d476
SHA512 0f35060121030e316dc04cb68213607839257c4ce58fc3cc8e048bb5bc04e2ddc6390773e05b260eac800dc5e5017d483a8322196670bb11d42bd35a81fdb0bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee812d4aa53a335914b66ab5034917a8
SHA1 8fe456f84a0a0b4fd83558e59fc8c9ba30ac1dce
SHA256 186843bafae37ad085a778df9d72523522d564e2104e9d2848e74bd9c8dc38d4
SHA512 6aa93697348cbf453ece5d780ef682030af37c9c59cfb6595d7aa2730513aa190ec422c98957888edad15abc26d661b01c02065e1eb8b4665e78808199a06a90

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6140a04a8987d544bb2a4a538d45b5f
SHA1 361b5b6b6f57a7031bf3c3303c1644b1e5237e41
SHA256 20556c8bec5e6274bef6aeb931cf501c59a45663a4ab8208f424a3e35ad6833d
SHA512 cb42c58d41d0280f108345191cf11aec81af0317023c746acbc84694d9081e616eef247368a7d2f25cc7760a19a0a61bdd9a96686e4a74287b1f57f0a67adc9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5f76944d92b916199411a298eb55119
SHA1 e3030d4511d80c8ee08794d83dd71718abc0d18c
SHA256 58b95477b333226e28c79405b7669c158e341b58324f49cb6244e883c2fdbc6e
SHA512 7c6a331cc5c45517dac592f09fd7449b8ec0952cf47629922ec32974299540d0b858490d8157621e99d071618aeafb54461fd0a5c34a26a68afb49b1ef777ba2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5be959f7ea2d2fd6aa2cdd9398c02d3
SHA1 422e302166e935d12ba48b3f4e093450cdc1340b
SHA256 ab1f19de4a1d698b361d3ec216cbf154dd65a9ad6fde757c0d7f49523f99e8dc
SHA512 9eebc1626dba5b809aa7361619bd5f0766db841abbe7d357b90b5553b7da3edcc42fcefe2b5ed3ff585a5c4902438749b17d8245c1c82908bce826bf8a1ce218

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4ceb7a2c4553401b5cc5c0826de82a5
SHA1 0988f272f8c944d619d96751cfb9c1f40b22b52f
SHA256 67df5fdd156b3fbd8189bfaef76380b022855e0ca6032017dfd214378993c002
SHA512 f2510b9f361f1b4a3080fbdf53d250ed19e2ba58cad9b068fb8c69f4433fcb7dcf87fe35e10d3e68c9ba47569f0263cf146ea43377e9ccd55a0e745d3bb030d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5ab21ba7538f6273ff8733c0fe93a24
SHA1 f9dceef5f50f34dfc5257682a3504ea3f5d4138f
SHA256 48e6f93626fc3178f6b96a351443eeee45b180ca6fda29d10f39a91c94176f2f
SHA512 4ac94c0b2fa01a172a7a86c00afadb1a1d2efb17b07a4c441bb1fc7a81aa82cb3316de87b8d0aecaab03d73b7a15441c7c10b3532fe3f70469a68e32bb00e314

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 edcb672059cbec24bdee0129d81112dc
SHA1 3976a6584c6ffefdf618ce60e86b38ed7f38b83f
SHA256 5d8ff785db83505ee9e407c4fd04ca8123d304b55bda9de70ea1d241ef9544e1
SHA512 0509ac3e14ebc176ee9c05b671bd3be5b46e2bc5dbd582f5d0f56494d055e29ff53a8131a5fe6286f0426107a7df8a6c4c8a47b2ce4a2bf602681ceffd43a779

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-22 22:46

Reported

2024-11-22 22:48

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe"

Signatures

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\svchost‌.exe N/A
N/A N/A C:\Windows\System32\svchost‌.exe N/A
N/A N/A C:\Windows\System32\svchost‌.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\svchost‌.exe C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe N/A
File opened for modification C:\Windows\System32\svchost‌.exe C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\System32\svchost‌.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\System32\svchost‌.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\System32\svchost‌.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe C:\Windows\SYSTEM32\schtasks.exe
PID 2772 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4168 wrote to memory of 4796 N/A C:\Windows\System32\svchost‌.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 4796 N/A C:\Windows\System32\svchost‌.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe

"C:\Users\Admin\AppData\Local\Temp\0a60ccc70306d123abe0cca9c282b476792015f0de3e1df4395f357b18c10534.exe"

C:\Windows\SYSTEM32\schtasks.exe

schtasks /run /TN Update

C:\Windows\System32\svchost‌.exe

C:\Windows\System32\svchost‌.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1

C:\Windows\System32\svchost‌.exe

C:\Windows\System32\svchost‌.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1

C:\Windows\System32\svchost‌.exe

C:\Windows\System32\svchost‌.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost‌.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff830d346f8,0x7ff830d34708,0x7ff830d34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4260338714945538062,16887576379063373395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
US 104.78.190.43:443 learn.microsoft.com tcp
US 8.8.8.8:53 167.57.26.184.in-addr.arpa udp
US 8.8.8.8:53 43.190.78.104.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 mdec.nelreports.net udp
GB 104.77.118.137:443 mdec.nelreports.net tcp
US 8.8.8.8:53 137.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
IE 13.69.239.72:443 browser.events.data.microsoft.com tcp
IE 13.69.239.72:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 72.239.69.13.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 learn.microsoft.com udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp

Files

memory/2772-0-0x00007FF8221A3000-0x00007FF8221A5000-memory.dmp

memory/2772-1-0x0000000000340000-0x0000000000418000-memory.dmp

C:\Windows\System32\svchost‌.exe

MD5 3ae4a965680a6b9572c238cb51cd0f33
SHA1 850b303af5b5818c8c34cd88ce67acc6f093c248
SHA256 51f1e33f84709ac4ff359e47fc0c98395cdb12bd70feb8af78e40f494ef9803e
SHA512 328cafddc052b566033bba0e5714c0dbc53e7c442500969a1a556e9fb90d97fb9efccf233ac4632d148b2d6350c54a0e5a8c6d4be5b19b1dcba04b0a61e17bb5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

\??\pipe\LOCAL\crashpad_4796_LUXROPTWZJMMQLLQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b99e264386c3f8aefad11ab6e1c648da
SHA1 4bfb3047ed255a5226d4e9dff2e5e9fbb17bbedc
SHA256 9dd2f542c83992bbb8abeba0bb20b1d0c352afbfda95b32780535960a4c06610
SHA512 6cf70244edef00632c0c5edaac9994bc6d8861d58d350428d19780c5338cb08cd67794469714f90ae4aee1ae4712c836e20859100856dd09259c7471dca42b6c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c7eaf4acc6c1f871ea494272b1b0ba1b
SHA1 78b4090086e9c2b66f6ac02155c003297a9cd43f
SHA256 bd1e63fb4ba12a2b8aa9037051a6141581e6c4ee4648287f9df95e84bf69a836
SHA512 23067037a7cc72aa860f64ee304e632a040c87c5e14ea8f7fe209ab208acc1580dbc1a0d8698539d354024cd0127781732ff29a66cec271ba6347a057502fcf2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e5b65724868b8a45fb03499db39da11f
SHA1 20287a1e0cae6adca72c8aa7fecfbd5b8b821c90
SHA256 8f1549907bc2616c6dabcb95c5c49144768b3501f26127efc30a60f0a7879d9a
SHA512 60b2d6bcbd74dec0e17c205a5b09321b9c7c0b95da5ac36930ef777a474e7ec5a548a8e285cb5fe2fa28555b845e5b1d375ce80f18fc4ff733f32c40bb74a90f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fb2bccf4d5da3ed2c06b61e935b0bbe3
SHA1 9f03348e0278eb832febaa992f344274e5c05d19
SHA256 fb55d04242680362aaf1ff5039badd2cf33d7cd5af09a5ac6583cd97f0808fb2
SHA512 889af3594b84a3b76e6f1121ea091900d624dc8d314ba79e55cc9797b02b1ffb3a37e6a8c7bf357d9b4687ab9771a4572119696fb918a1eb1e6dda38b5810f63

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 32fe5c41c8be4730533b24849eb992d4
SHA1 a7c6fb7380ab8ba18a92ce65709bb44373770d3d
SHA256 174e2b276c85066c277f923bcd1bfc085c0b3a836e1e4eab5fbafd5c9b804411
SHA512 ba15cb8c63de949ff41b2fa0cbe6a073ee3f446d820fa49364f449b342e0f8ae58868c141f155734855c7679f5d9038e6935b513f782d8e073df84a58be81436

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

MD5 6c66566329b8f1f2a69392a74e726d4c
SHA1 7609ceb7d28c601a8d7279c8b5921742a64d28ce
SHA256 f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6
SHA512 aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 e51f388b62281af5b4a9193cce419941
SHA1 364f3d737462b7fd063107fe2c580fdb9781a45a
SHA256 348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c
SHA512 1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 522037f008e03c9448ae0aaaf09e93cb
SHA1 8a32997eab79246beed5a37db0c92fbfb006bef2
SHA256 983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7
SHA512 643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 831a0aa25af2c60a7380ea75c321d930
SHA1 140ec306c24ab6f348c4dde5900b219d817e2026
SHA256 8cdde5daa52335c0a4e416f6fc22aa80744207a38fc276bd65341c2d2e903557
SHA512 0147937b2b2cf9bbf7e8dbee2d598e156c6ce4ddff224b3dc48caed96e89038ecdff1ace743b82fdf6155c40b674f4b1983693dbe45c39898487d3b7be258161

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 240c4cc15d9fd65405bb642ab81be615
SHA1 5a66783fe5dd932082f40811ae0769526874bfd3
SHA256 030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07
SHA512 267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 4d0bfea9ebda0657cee433600ed087b6
SHA1 f13c690b170d5ba6be45dedc576776ca79718d98
SHA256 67e7d8e61b9984289b6f3f476bbeb6ceb955bec823243263cf1ee57d7db7ae9a
SHA512 9136adec32f1d29a72a486b4604309aa8f9611663fa1e8d49079b67260b2b09cefdc3852cf5c08ca9f5d8ea718a16dbd8d8120ac3164b0d1519d8ef8a19e4ea5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 34504ed4414852e907ecc19528c2a9f0
SHA1 0694ca8841b146adcaf21c84dedc1b14e0a70646
SHA256 c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810
SHA512 173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

MD5 6e78ee324e008296108bfcdecd77e318
SHA1 f7c39ee02c65bceb2c66ad2d7f45523feb5ad156
SHA256 eb7a4ff0f8ed4c8a95b2183968b5a59f4058b177f580ae2d2bef4595b6f6e092
SHA512 bcfff936bcc46ab4120690cff3af93491080e13084ea2bcd8bce1a2470ea86eb007d695aef23b73e0b84cb3c7fbf351d025be47ec5d232ab613a420074f8a448

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9f4be548fb0d61d64e5b3508d99c5c09
SHA1 7fbf800e49360d0a2feb700d9b6cfbb3334e93ad
SHA256 3ec3fa42a41d11b7a8e565284489b49bad6dab79ea3549f6ee2676a79d6365ec
SHA512 8627e08c0549935e737fd8b7abd8a2d810821cc81f316cc1cba284914be2bc79a151f88c74d497c0d8bf21792164f3613d6141d233563871a767131e8a8aa2bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d973.TMP

MD5 cd7d8fce4ca2f229a0958b0ec4b49221
SHA1 de8f7f66b7e205e040bd6c44ebee0fd90fbba2d1
SHA256 997032e243e4dfd08f8de3f72ec3b85cbc98a6917753be40169723ba01f3e5f5
SHA512 56faea4d0aadaf0c4924b9f1d57059638d6fa0dd70479981cb25022146979e7cb39229a715d62b341575416f98aeb07acc81aeee6a3b95753d768ee3d8dcecdf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80f97050-4eca-4a42-a404-366712ffb481.tmp

MD5 e24e23dc8478c944482dd12c65db8a3c
SHA1 088833fe07b25885979aa059fd8ed9ad31501162
SHA256 47b1e18186b22d6ad095bd430db428995c11e3099123ac282d33b1a44a055210
SHA512 58538adf5cad75f9ee5e492b7036673b84f42c1f308083dc966cd76ce7be86a2b78b230421c403960906fb1374f815a8709132c6d9a71bf0b975d9c4f09f3830

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d6c93150f9b571524e271d282fc2cd8a
SHA1 1e69715f7ef68a2b08ab50a535d919ac2f914aca
SHA256 2eb939a623f3e99d98d8f76e75e797071e0e5e73cadb7d6a39bc6dd624958b46
SHA512 a38acbc3628d84b645790e3720f89f01fd79d8d9c4f778696b679b87044e5d83021e138caa271c7fcb12ffad6e6ca9e7e50ebb10d5649c6891cfa8bf44398f5f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bbe72cd5e3070892_0

MD5 5f3876edf67350bde1e4b6ffd570d22d
SHA1 be3f6ab1b275766792f93d9206b771695ae448d0
SHA256 ceb39b956834938f375200073725456d50095a56750cb6d6888c08d57b548df9
SHA512 c6fc3fc773f2a7e06d7a7d3faeeca59ecd57afd4f3a73a7967a3791fbe2d73768d41bf8c8ad9b5aca218dafdc1a2edab757ed8c3b9d0394e8e45b277466db44a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\43b9955e472b7d28_0

MD5 a4f78d3192bf3acee7c2fd4fcc190fa1
SHA1 dee59aa2ff7845e9a4e9bce1a03f2fa255d60279
SHA256 b730e8bc834057a6cac060099b6c7bcbfff814a60731c3165de6591256385b3e
SHA512 4cf33443347edf343e8a74ab5725e5be9e1985f73512c90f8532f6300199d3327b7633cbc0dbfd05b721a0ce95c101b1312058da2886fa5b000f1ec307deb316

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b27b4e0687c2dc36_0

MD5 e941be0b55681c4760b90ffa679225d3
SHA1 d486d48af8a8e9d02b5b913b336ee383a46469d8
SHA256 e5ddbb01860d275e9e60cd4eefde12d1295037d4f6ed5f702f306e2f19c52082
SHA512 68ff800ef053b1187fa5a86a4444029879039d937f7cbbca224f3d8ee2c03977ce34c665793ce648ada6a7076ff2ce21ca608b6e5eacd9345726d397bd28b162

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e20d92deda6cb352_0

MD5 3ee2b5caaa93e680202cfa11ca280012
SHA1 8c5b774b1ea0f39155ab98b09351b6e6eff5dba9
SHA256 c3779832fef460e8dcebf16f72f9f4296ec8496afbaf47fc6c1f18a0276656ed
SHA512 2fc3a80039bd57d8172a0e7f9ff654a3b68bafee43217cdd2fe0eb46116f90f991ad25f3fcb7ab941c342ad7d5929da5499741c78f01ea04189de210af54db2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

MD5 ad4f9cf3db6fa96ecd02f32ad4730215
SHA1 9e114d8c050aa7ad54f3dcd222679ab1ba79d68d
SHA256 b702a7be868e439f738efe539dc6983799bb940a6ac1c2430e77283af63313b0
SHA512 6814e26917cd41d62d57b5a63d7e0114bb16c7b0d96fcbced6933a273715d0e87855d9cb3dc9d3bfe26d661edf27780775866deb417a546881fea2ece50e3477

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd170a2f734f322f_0

MD5 5387766805516aec752593e360ffa122
SHA1 d3a98685205a604072251f57ffc1ca6d62505e66
SHA256 0da5d9a5686877e8c21fd1e682ba527b0086b41118f39ab125814636ff6304b5
SHA512 924f9b0493fdc5e9bae551870486e059faf25df3ea98820d7e600944c723a4c7b8d7414e9c68d5d4201a1d4dec89cc95b6ddff4a41e53ba514479fa182777b72

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

MD5 3579d3f8bd39c4fe9b8d9b9f8e02b3c9
SHA1 2e9c6b6549047d9cfffeb53f6f6ae41e2970c3b5
SHA256 6bdcebbeabd18c18f07543c903ae4d15fbd71fb4fb34052c7e44ae6c8e85337f
SHA512 fde4a4b3a0aa8922f8f936dc3c2931db500c9a96fb6690956f6c7e00365dac46a464a7221669c18d81c62e3c4927d6b3feddbe7b7eceabcc0b92e83069d63d48

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bb04b1f98935d973_0

MD5 1647d429a83b10d0c4507ac6aa6f116b
SHA1 315d5cdd5a3f5f4b02c4ca8075a4b9511d2f3fa3
SHA256 63900ed02f4e0a6e8b36d68d4c3b892e60291a0b0dd344adb16b5446be6245f4
SHA512 67da7112acbf2022d2344839e236d4682116d400b9b3f2b569895473cc5eddf9fcdba64b558be4076d9a5155a7b0d1aa6aa2c84c757a132d6c67a823661c5484

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

MD5 b65814dc90ba16fef77968bb1990ff41
SHA1 e418c377b77f5adfbd815c5224c7d40a1e7fc53d
SHA256 50354c96a1d64ed155eeb509d0f9afa1cccbc05b6e6e9d6f52572b8deaedfd31
SHA512 ceb12fff7baf5d08ffc49725a2a65ae598b44b7fb3674c1c8565869ff20446ad187190a786afb2d213a879d8ed1d1610bda283030c98b41daeff8184b0313666

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8b2428f288d326d08599a716f3590fe2
SHA1 c9c6a10e025bc95ff4be20baf43c384ef3634560
SHA256 9b7a7d21bf66947fffa6180cc869b27ab401e97aa2db3c8debde6a79f62bc9c8
SHA512 b50ec2a23044dcfbd5e720eedd0fda6609f56ad304b8944f49dd58170008cadd8d2bd45fc8bdd6dc4432e4db1f7f93fcdbff7622ca19773ce84a0952f82c8c2c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4c64e14144eb829954ba351ccd8cb463
SHA1 794412acfe7db10c5ed45738c7f2955cde694d6a
SHA256 b12fdc44e70912de5c5e107f28ebdd9eea4c88ec9752f9bef127e3781414b4f6
SHA512 20199614d4839810d27056928cf297e41afb5da541bd5c8c5a58c6bbc81e94f488d2fd0d34d1b8dd3b753f9b3ce545efab2f0cd4af1666ee2065c80d337b294f