hxxps://drive[.]google[.]com/drive/folders/159BXvJVxlahOEwLnZ9LC7CCobNo6d7kR

Analysis

max time kernel
197s
max time network
199s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02-12-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/159BXvJVxlahOEwLnZ9LC7CCobNo6d7kR

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: code-prettify@master
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
20	bitbucket.org
1	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 56 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\Registry\User\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\NotificationData	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000850dbb48b018db012e0b5d04b818db0196bcdd906644db0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BehindYou.jar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
1784	msedge.exe
1784	msedge.exe
5008	identity_helper.exe
5008	identity_helper.exe
2116	msedge.exe
2116	msedge.exe
4820	msedge.exe
4820	msedge.exe
3308	msedge.exe
3308	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 584	1784	msedge.exe	77
PID 1784 wrote to memory of 584	1784	msedge.exe	77
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 716	1784	msedge.exe	78
PID 1784 wrote to memory of 3896	1784	msedge.exe	79
PID 1784 wrote to memory of 3896	1784	msedge.exe	79
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80
PID 1784 wrote to memory of 5060	1784	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/159BXvJVxlahOEwLnZ9LC7CCobNo6d7kR
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,9364401532578610964,16881646746484193094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
32KB

MD5
1f76396a01f9b997d149642fa19395bd

SHA1
f26dd69ff0c45d7fcd9553f0cc5caeaf5410cffe

SHA256
c519c5d085e60c32c52df7706f00daddd219415a5aa2c45d2d7d9dad1e5ac849

SHA512
0153e322815e320bbb18042488bffc0bd7a7c6c063c9919284086496c58865e4da89b3606c0f58e1b7c0a07380dddb2e2a59f967966868c21c26670c215064c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
93KB

MD5
26870c845ebd0f53974b9a9895edc977

SHA1
d1b96bf6de2ec42f494ee8ff89bd808b9df41429

SHA256
12fc12ce3256d654897595f0e78a11bb1c98c32a47a6a5cd614cd2bdbd2b6010

SHA512
d12b26d9b7b45fa6c26941abad6cb8d844f23531f1b617c94167f6f05a02df3a80e9764533b514519afd02793cfaca40a26f742e067d446125b3c00fb3fc1144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
75KB

MD5
49840126bba65a7f4a97e4eb654b4917

SHA1
7b155343e4eeb5a1ae52abf305a765369cdbabee

SHA256
e5f921821388142722429c122b63124193aa61a2984aa6b117ee4ae98ba17373

SHA512
5b0616f750677c2a7d7de09ba4195e6fbfb60712ed772591dfb31ccc0fca7097b4b039e2dea7553afeb19724e0e6431dbbea177f393bb055493d68240e85878b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\11021af79e5f5613_0

Filesize
254B

MD5
aa4bf0b4c369358a436c19885bfc80f3

SHA1
74e8f2f1d249a31f1bb6a1ee80158fe4b9a620ac

SHA256
ec2b577d37c4377e73d379cc2cf8a87288b9740094553a63571bcc9c91bb86fd

SHA512
a18becb42a076420a775cf8f2da844f3a4e215f3e9ceee34328ac7e50506227b1f227803e3ddc959fcbd7fedea03dc0e393400584af72692871985599d38db46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26ad1b57d37d5735_0

Filesize
394KB

MD5
007e87ce5243851f85d2ab79abca0291

SHA1
498c3c7ff5b4a4e40c9d566ed24706c41fac2153

SHA256
0fc829865fcd7a5a6d2f7d3aaa902db631f27c406afdbff3656cc3b1a3721d01

SHA512
a4862593cee7cac3a64e323d33cdb17661d31f277aed08b38db0758779568f1d42c9aab91d14e60905bbc74b6a98c6ee4fb50756705a5d73e6c0c91c4437993f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a61753715bee783_0

Filesize
313B

MD5
d9555de5f0b78e04c926cc2b124c4186

SHA1
fb3c3aee65dd4462ac226779b84715a8fbc09e3f

SHA256
50802b36fd6283eb791bf63f5e03f41b09765dc021fa397da4c55b07f2833d77

SHA512
f711f1285af110b7004731a656311aba484790bff8e54131c52fcc9f38bebcb9d31d9189b2735382f8d0c2d6a2f6cd91247fec85188a4e194dbb827138de4e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9559b6c81b7b653e_0

Filesize
76KB

MD5
693e0fe829cc5bf201924e854cdf2590

SHA1
8892e4b72147c55b4f688889211a7c8523b53fdb

SHA256
04deac9f1114788f128a7cc1f017261ba9e334bfedc15d6af489755af56b7ad2

SHA512
8b5729194ce1fe2900294a174f3244a236607ae03b461520071ce1f453a0ade51e0c9316c1dd4471d7335ba744f8ce857fbec90c83063e6408cbdab555238d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a44c2261f80dfe42_0

Filesize
269KB

MD5
30ce7f86ff4862d8bf87c60d2605649a

SHA1
5c2cca93fa58cf9b60883d71f4e66f32466caa3d

SHA256
2c0fb3ffe1ac7028420dc38f696a1512e57938d25440ea59721401af08240983

SHA512
2e8a469d50cd85c842b43a28f7456d96073688a29d9c35d8fe0a7421f7d7e3cb3a279b40d8d8b5525926e7d4dd330d10e8a5033072ea03546a75b6823ed2d6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f31b09b6cd0997d8_0

Filesize
265B

MD5
e8f29af1e8aa2c825a3c48f7186d83a8

SHA1
2ae65d702e32168d1244a8bb96834b9deda9948c

SHA256
b82e2231ee41b4919dee5ae013832812c88d4cae2f32e4f0bf32c2952ff4ed30

SHA512
45bd317903c0e019d5413b6a01618e04538aa6358f0901cac268ef3b05e3464d24a6bed8d14bdcbf5548cda7f70787d5270eb897819af516e304ba65a168427c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d22747b14daac767334e264c5d86737f

SHA1
ce11418b8092edd4effc95ac865b23a58112cb51

SHA256
20f948019898e88d59ca61052059c99a1d81b994a4b5e656d673374cab722e1e

SHA512
88b283a1a75a4a0f3b720d43e5f678653df9f6e38e2406b4fb32eec5b205914def9e7ffbd1e01ede76e9d19d42bff6448d103005f985e2d62db2e507f77c8dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8a311c749e759ad3aa261eed37aa652f

SHA1
90429abb7779ef811cb1f4c66591d56de57bc441

SHA256
15fa17ed87fb7cf2689adb1335ec1c078e6aafbb1b8c4768bb77261b599d9327

SHA512
c26f8f0a6b1ad8ed25b03247a7dadda7ee522e16cc54e2e46eb3d0230b52bcef0148d4520bd5e446560b5b9fac83ebd8e3cc8e8143906ebaefdfe72899ba4dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ce343e5d834561e458f0600d52cb215a

SHA1
2d6911a2336ea8f31212271fe188238672a4c93d

SHA256
fb7bfb96c7126b6f083ece7e992b0552824a8f4e6b81cb8e55ab9a20de984e60

SHA512
718d355376165f94cc1a2c18946974affe89879721d12060bda4d27bb90e15afff36394ff6fe6941b4b0df31ab59d2885525cc948cd0201348e7b00ac49ef7dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
aeaebc5676b6ed8a3550d3bab31c16dc

SHA1
7f337457d3ef0330fdafb2b5ec627db70825556d

SHA256
ea35c4600fcf816fa6a90541353e9bb30b80e14e6545eb829ede88ec1c7cfb2e

SHA512
3f85c137d4a18195d39dfb1b62a376c72d1daf898756408e162a599c3f56af20d2f1fc628a1f28a2891f387bb203ea3bc1e0665849a4afcb844346d28b72ee9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
0c09c6867e5ce004b22e0784f196910d

SHA1
31a49eaa4e70d281aaf07b723c49ce8f101e8d1d

SHA256
78f6db3b607c1dd977b1aa18c3c79a1ceb1002f2b97bf2e4fa693bd2eb987e90

SHA512
eb56205c6cc62d2c2f130452e044a9686aa52effa032c41ab25ba43bc2936dc49f94059af67435236bb0a35b2f1d8245032bd2d06007a6f2702f2f3b8c4bc761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
02ebec331b6e24331a53b22760e8ff95

SHA1
ca219d39fa8d52ecc3d10daa4683f07b5ac04aef

SHA256
ba57bc691ca32c5fde885f0ea141e8ed9afa88dffc6c250c7af437289b70eead

SHA512
b9c3f06019d4883abc6ad516214f1c01f2d7d79c1238b5a52da99231ea5eb4a1b084b477be3af72660519a34931f067663ac921cf5e57d8cffd88bf2e06497ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
35f8353abc8b4e8a36bf49ac9b3b5e14

SHA1
550fb1ac8de5a13c2b4d26320bba3f5f656e6a7f

SHA256
4c261d3a0680cfa01cd1fbacfd3007f790e262cc234e19a992b66b68043fb472

SHA512
b9f3164f8f288113479c467e9c478df186913a9758abc9088b2195351337bacd5e69c1510ac76a1b7cf3de8756c12be1df9217518e56c47db8b2459850980531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
290fd173cc26e84af4f75e994291dacb

SHA1
e09ebd172fd2e8597f230d16e2e3ca458342f6c1

SHA256
bde60470507bc08e359f028f6e991ef5584e007c7a497cb719894853bf47b249

SHA512
9981841cdb486d08cbedcf2d79ef313b8b5d99ce379d8eb5f69de58cdf91e5fc63981f0bbe00efbc66b0ffce3a981fb0de300324afa4304886c345180776d3ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fbd74c33ec63199d9f3760db0a96ac6b

SHA1
493f774a43c70d04a0e264b12bac696c83f3d9d5

SHA256
3fb7716e99f54833cbad9ca6c256c61f7dd7c1155c0ad896b61b21b32e515f8c

SHA512
238661b1b7e7848705125a15cc3ae1a5d786f243c927d6c36690a9b78ead27b2a51bf4b534282600e028f880d4a53f997278af54e015b29c111e1337885d9899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
19a1d3b6899d5ea16b761bfb1f060838

SHA1
dda802a8efd0db763039c8a119b793b823a65e02

SHA256
28836fe6e2e440e871d6961f83d4cc630c50d4c41056d248c32e1bc746f0ce08

SHA512
4c0916f86d4de2b11fb9a5b5b9c52faa3fd19b14256cb775d4b5eb4453a41f70c44525dbd8c7631aa9a5da238f3ac56031d4b92ffb443ac28ce0fe548c8d6924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a292ae072cec208673a98b5fe69aa355

SHA1
baebddfb768400395f0bf4d1304e077a52284f6f

SHA256
9bece39160b2c71577b58bf3544d81dc07ca0841a0270a39617201ebbe52bf8d

SHA512
7860446b1d5893131d5842b89573765e1e4b711a7a342ca65ed5d1569a74c7554036fe4931eeeb349bcd7491a66c00b870e880f5d35884ba95e4db5a5a75ab8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
808dc84efd1da560ca83ef5cd197fa9b

SHA1
7290a674897942a25b9fc97f1adcf7209ff0b04b

SHA256
886a5df10ce009ad07f9b7035c2013279f9ea18a177b847df5973b25eefb7070

SHA512
cdd43a032364783e5d6b61ef4bef03ef26d9d85a2973fb19dad803a69facbf91d65754cc65e1beb10644630cdae5b7bff495ab90d33b3eddd166632fa15d717f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84a57f9bbfdbd511aa5cea43b3d12c9d

SHA1
4c32b6f4dea81a171a958ea82cf5c77d68c9893b

SHA256
9fc920a43fa8de964ef4b54c89defca601fc4c1faf7ea1a2485ee1c00958ba85

SHA512
b11c4b0d9d1d528fbfc84e2008e38998bc70ac354beed93b87bb3da37dddd8c1af8cde376c93ccf99e78ea3d8ce1dc90a5a0f4e799e21e316e67ca01602960be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8403acd100fdbf89edcb977fece9792

SHA1
a5375340d4da27016361f284e824d5fa12a835a3

SHA256
fa5c401c5c5415947b68d7ff95aee80dcbaefeb0035eec11421e0590ec102f0e

SHA512
5c38938a69e504338d8f8823f65242dfed05c0946698346605e927050d3dcedf44293e89303cba78b354b68b840fb4580922466158143ebca1ff7f70d7ec1adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8da9198f7389297d199bf4ff261cbf6f

SHA1
432cf8a84a38797ccf8af0e22a6f812bf19ea605

SHA256
540f941220b8774b4523a8e26ad9f79f74fbf41e05da2025546ce3f299ad0762

SHA512
620b74cb238e3b6d660b6b0acaf5efe9c3bb34dc288d75ad7f4be8f9cc0e1a12eaf5a1ba2a5ad131c8982fb00350c06aaba48c7de03a88e50d3c069ee6d3fa15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b119d3cbd5b255e254398ce08cf1d4d2

SHA1
088b80d770603071ccc3643d8d8f2d8bf3074c68

SHA256
e76680fbbe3a8aa721202ca7159db9d198f7f652f2ba814d02441418158e4dfc

SHA512
db1f6a9411d975ebca5f8a56f253a4b2637ec749061e9f0bf559dde1a9cccf39e04fd059da34c09f74e3999a24ca771eab610feb8a9c50aa8c1a37a524433b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a812.TMP

Filesize
48B

MD5
6365995f7dff8380d12902b97662494f

SHA1
3b1055832675b6a34db6e115b778cd1949a42811

SHA256
ef263b5802abb69a8643a7610ffba5001a505b61ee0944a98318b900a61586c6

SHA512
6bafb2c4150b8c52434093ad2e5fecc139481056e34511b3b8c074b3dbb276a33ba27b40863fe66f9fc7bd68fb5941f85eeb056b23d5e0b759c536e59e43dcfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8053f6a83432ecfea382cadda3a7007b

SHA1
f6ec2d714c6fc265ebccda0ec0fd3ea7d2d37180

SHA256
bc2b2b47047c21f7ed9ecccb9b78defcfcb72401600c3b1481eb99d969685ca3

SHA512
538a7dc9a256bd14dd35536b98984ac715c51985da369282037b69017111f4d2ec9f4099da170a5cc6caf220c85c561c709fb3f3b51f5d59a999736867036160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
15f3ccab0dc44831862876f5284011c0

SHA1
1e51bb0a942b0da598124f262f153b2189340e29

SHA256
5222c74857a92e591236d2acd6e48c4564dc8f6fcc7e0a3caa9f5d52eca86074

SHA512
9d5cbc511a8f3bf40db1283020ad188ca5feaa5ca163b1e074374b0b756e2863b49b699c4ed03e76bd8048cae82e4c7e28f4b44d35dc6fb5d7c2f776b5804da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
61c5fef9e7bb6dea830b14e4f8e500d6

SHA1
578471fa0f4fab9bb1b1fd13df152a765cbf4e8c

SHA256
cc6f592f3984437f44d901470cc2ac2dce64c5273c95694ac205524de499d2cd

SHA512
a504ecb210e91e0c7484b96bd24e7ccaa00ad720d5e308de98aae1ef3dd2446f3b588ee782fc8b0876967ec62db2f634035990b3d3c3f5d45297f01e2f169a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c771bbc467f38d0456ad1f78675ce0f7

SHA1
c36800672149ea50b6a21dba46168d7dd2dd2425

SHA256
8dd55da5ecc4d6eca757114fff75e99266fde2257f54ba029e0ba113a0bc3ed6

SHA512
5c882748930913c82efcce67d1cb25ad21de9938dee9579c95648b0b6dfb4463187a35f27c67709e83301cfac340348aacfc6bd4f91970fb206c8921589066f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c4242c56a71bd13cca9fb8cb66b20e13

SHA1
69cdc1e5c2606616e3bb9c00dcc739bad9a092ac

SHA256
ffb52c3f76a6f093199bdfda1e1038e0cb482bcfbe09241b2379197e14ef220b

SHA512
30f54b4a0840e87a837e04cb9aa7d877e8a2a65b312b9c14813b0fb45f472ff058cc2c185d51dbc7c03ebdb7960a5af3862aab27889cd2c3ebc20781579e4f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7f528d9698d81de700bc6e6ca10028e9

SHA1
872dcd9864698841222f6f3d7660b9fadcc0ac4a

SHA256
21c30fff4a8cb1fad949f83ac4cf061206adb3cfe9952a400976451894e6cfa1

SHA512
e3a4ff8846616f6c4fd5481dc0dd70c5e5c010d371f41924d1165cd3fede25f542a6cd9e9baa7a2e112b3e97840577a2766016e81be477c79f9f2249114d7926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
724612750ab9bf6aacfe7bf7f2c0a0da

SHA1
69126000c26f235cfd20668c2097df6ae2f4a1fa

SHA256
096424b470a0ac3ebefee7e40015263615067bb76926e6c1c14d51568bccc356

SHA512
bdd7bc4ccadd200c95709c6034ce02bb05c0b52583b850bf65ce16cacfa500cadc02ee0ba5fcde01d5991f987442dbee9718c35b9bd74511c276f2b0a52c0ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7b537be2d963cc92a2041d78edf7adf0

SHA1
3f8334e1dc3b5c075043fc89b8b3b14d44097d4e

SHA256
4413ade965647c5fcfa95520fc1a36f668848f68fcbab0ee20f1136d75ac0f81

SHA512
d787637dbd60dde7416dc5e0e6135817acfcf548d176b67d13f6d8c116b99b3a5190593b5093d3f879c58d3bf2b679d878bfd1a125010138ec086f92e9b0336b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6bc43576f616477f58dd76986b946fae

SHA1
b5f13c58bce942379d9c15878cce0091e5f58ddc

SHA256
8312eea175176c87bc8369ea37b3829d9ade3d7dc5a91fcfe87e11bfb3f19b82

SHA512
35a0ea8761bf3ff39d64466517b62c1fe00662b14c850ab3a3901ce7bd7077a08e315319c1c8cb8c1f23bd7ea09f096137f1678c84cb6960470f98e8113f5955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586ef1.TMP

Filesize
1KB

MD5
ff32c5bde2f3f27bbac182396711d78b

SHA1
ce46c2b633a78354dd0e5012982c3c240116f044

SHA256
7a3cb8e128856d988f5cde57cf050b5fe630b22c6827cfa16ec0564bfc67afad

SHA512
551bea90455050aed51989c058aa8612772b6654c8bf5bdae771976874ef088139192e94ba965442195cef1aa30da9c2ccde18af09f6f475baeb7c691a7f996d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e59d78116ef9197a7c514b8f5210019b

SHA1
8b4522fae799f020df2643d120981b1484b6065a

SHA256
4814f49eb8a251ba9d6db510c76384bd9177bff23a5ed5b09ef611995c178169

SHA512
ea4b88aa63f9896ed1571482d064d179fc143da8af1671a44162f4113f59cf584d956faf4783ccf9f21a226d35ce78737960ca8dc6bbd1fda07a0e6e1c278bed

Download Submit
C:\Users\Admin\Downloads\BehindYou.jar:Zone.Identifier

Filesize
186B

MD5
98f708784f90dc474c57d6ebfd722e7c

SHA1
a07f685b0e4ce948df6698c36597a258cbd3f4b2

SHA256
9855c330d06bf4e9d7fac6bd38c90ef5ee61ce6efd9d1f34b7e405a9bb889a6e

SHA512
2b99a8af0312e9a9f4db8c0a914375eaec1d5146d013397504908fd09fd9322a547ecf8589ff39ba262ab53d6b5829497dbb6eed3d845f50756f04eb665c0f1c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 927452.crdownload

Filesize
27KB

MD5
4e0b8cef99ceb1adf8607a2ec9703862

SHA1
d0d0ba649a6a3d771d899cb88bafada4d45b0c07

SHA256
4ef214f5ab74f4365ad6486ce4c9d6cb89978545468764480618a3c2fbf9c3b0

SHA512
9b0b78ae2cf4e88bad145b2c3e087d0f98df25047fad8c406073ec1ced1305497e3a207abdf819ca1436ba747ba0ed296ab2e03c428e6dcc80073877d4c93c46

Download Submit