hxxp://steamconnmuntiy[.]com/gift/id=8237689101

Resubmissions

08/12/2024, 04:42

241208-fbqxbatjh110

08/12/2024, 04:32

241208-e6f5xssqd110

Analysis

max time kernel
328s
max time network
329s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2024, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://steamconnmuntiy.com/gift/id=8237689101
Sample241208-e6f5xssqd1

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
848	msedge.exe
848	msedge.exe
1696	identity_helper.exe
1696	identity_helper.exe
2744	msedge.exe
2744	msedge.exe
1632	msedge.exe
1632	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2128	msedge.exe
2128	msedge.exe
3580	msedge.exe
3580	msedge.exe
208	msedge.exe
208	msedge.exe
1720	msedge.exe
1720	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2100	848	msedge.exe	82
PID 848 wrote to memory of 2100	848	msedge.exe	82
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 3804	848	msedge.exe	83
PID 848 wrote to memory of 904	848	msedge.exe	84
PID 848 wrote to memory of 904	848	msedge.exe	84
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85
PID 848 wrote to memory of 1496	848	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://steamconnmuntiy.com/gift/id=8237689101
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbbcb46f8,0x7fffbbcb4708,0x7fffbbcb4718
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13146913115146214025,3773706505371511721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

7e1b7919-dc6d-4708-9402-964b6a6e5f9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e1b7919-dc6d-4708-9402-964b6a6e5f9c.tmp
Size 540B
SHA256 222cc6cdd13ff7b7c5637199e260a49a46b64835c53074bff50bd7215ebf65e7
MD5 f64821eb5c4545aa23abc4d3f18d347c
SHA1 3e2ac68139eee05152ae421288417df46802fa8d
SHA512 5f01e6bbce3464e865ada9b3e1e76aaceff98d8a772055d490a7a5c4d7a90df49325d8d269a9b28e040fdb601f38445207c857195774768f54a0317bd79dc197
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 27KB
SHA256 878e34b89800bb271d3588e526eb3598eb3822e263f3bdaf53645847d39d0ad6
MD5 638a4990025383a0f83ebf29bdb84a68
SHA1 153e8818dc42f598e47fde8cf398f1447649a4d0
SHA512 59a505fa1a3bea1511e8fed16dced733299928b4081665d3e3fa4fc71d6f0ed0b09934805f442bf190c9093937e1494ac938167f9beaca0223243703f73efe87
SSDEEP 768:5OnVLPSyuIB23TDhKBYSNLb7rd4BRIU5Gjj:4nVrOIeJsYWLuB2Uwjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 111KB
SHA256 199b281472b5e03f92a02e91d4f0dc88b91b641f05670a74e1b3507e09b0727e
MD5 ece822ddf599587ef262b1b22bfeaa47
SHA1 d9a8d480342a2a675c61452df0957fc6773f02ce
SHA512 910fafc0f1915a64933d649cea2b80fef570872f792320c49217b6fe60e49e2d32a7b0f698ccc7f91bd444aa62911ac2cd1da6897cdf3c0a27a3c54c8aa9d638
SSDEEP 1536:nqwoHCb7Yryg+qB0ZtvJI1VcNwh6VvftvRnmy/kSJ1r1KGIR5+UfHgfDhdJz6x+B:qwoHsO+q+JIH+wQhmysSJfIv5/aJzke7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 20KB
SHA256 d90bde2cee49d26d93cc149da64ebfe3b57b6f391c1fe84c696a2d5e3f33b3ad
MD5 1cd9f819fae888ce4860b7f6093347f1
SHA1 04f78da120741f1198d595af811b2c42ca9d5406
SHA512 2f7e22a0b36ed64c6be176f48f91663bbaca60d7a4ea862a6a81678fadc1d8df31c59a3266d1097654fb52345e0d2e292b8bf48e9497be9c3e3be89cf43bf90b
SSDEEP 384:MoI+jeGeOcFPt+ADJ6gmVJGpUG0FhM504FzW5A25HfbMn3:Mz+6bZlDNDCG0FqPCG2FfbM3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 32KB
SHA256 45b526e6aa5356b278aa37e67593a25d09c9653e8a0e71fb8e155111d3b7a515
MD5 e13edde4a25e96e573f37bdd11e020aa
SHA1 84a0c3cc6cd74b149cc27de2b0fe48bc2acb70d2
SHA512 9ba4cce47994f949731e594538f56f423ee46a8e602fe922ab6e1d173b87831ae5a80d967d695fc45a08b25aef5c494518b43cde6b4709db690e904b2cc1c053
SSDEEP 768:c5LZZyaqEnMV2nWptOb77VntFykydUa4wTKkpYcP1CFpMeXa:GbyaqEnMV2Wa7DFykyd1+kpJNIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 36KB
SHA256 ff066f3e1ab3028b7bf326825772da1a50d4c9bfe92ec0abcb52f17ed996482c
MD5 47d88f0e30322831ac51429e321af624
SHA1 0a3a50ae8c9d61a6d96b872f91b4694187be0bcb
SHA512 416fa132223c396c6ec4ba581383ff0859ee02a7e73acca4836df0e8154600cc9cfa4249832d0370fc7c45232e0114994e7da36d094cd459a6f3c77be539cece
SSDEEP 768:LdPNBv9/fmd5WckNpMso4ZARQXidAJ5Kq3lpcOEjuq123eYctLFQkB7pKS:LBv9/fi51coYARQyYVKO031lYctLlpKS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 121KB
SHA256 045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
MD5 2d64caa5ecbf5e42cbb766ca4d85e90e
SHA1 147420abceb4a7fd7e486dddcfe68cda7ebb3a18
SHA512 c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96
SSDEEP 1536:v4Kkq/szjKJRIDCnR96guXgECINo28BZZDhpkemOXaxq4jKea8GyFLaE0Af0ffL9:vf/fxn7ElXxE0wS0fj9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 733KB
SHA256 12ce433c3bec3e6e3029c52dc3a20a1d486ac623aafc8960421d223d00468523
MD5 0fca09837401a3a8e05aa46cd1a653eb
SHA1 b021350e90fc433e720eb57fc10a13b434fbcc15
SHA512 62e005b4c657e7a3cb785d426ecf05ddfc2f605b5cc54d440975e7255013a9ad8ae78aa50c26981260134650b6e6feebc3ec6703601d277dc2c82da1fd69f6e0
SSDEEP 12288:yw0KaC+NZ68BtKX59R0I9be/eDNE7ZMvwXG0McFYUhtt+ggubjZasISqdUOiAdJt:909CA687KbRlbRDsMX0M/48aZXnFOiA5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 115KB
SHA256 0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6
MD5 ce6bda6643b662a41b9fb570bdf72f83
SHA1 87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8
SHA512 8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86
SSDEEP 1536:GAAAAAAAgsAAAYgIAAAAsAuErzzzz6mfzzVCA9zzzzzzdp/koLAGXImE98YfgNi9:kErZDE9BfgNiX9k3SDHewStfNwS0fj9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 491KB
SHA256 69a47ea33e7fa0226b9f23b5837a9075f36a0ffc2e7adc2f5b30f564e1dad09c
MD5 eaa918479400786006bc5a37e77075a2
SHA1 cb892a61d8643b235ac589d9e0fd7a4a97ce56a9
SHA512 52bcd20485323c7451fcfbacf51a3e5366031198177ce53815ee031a451219755421da894edeb8e26a83ec84d7e52217b26158ddf5b0449bffe8f286b2238942
SSDEEP 12288:vyy70uBu8olN1OkoyLscRq3XNDLNLJ10A:vydHOkhhqXdN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 119KB
SHA256 6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc
MD5 d45f521dba72b19a4096691a165b1990
SHA1 2a08728fbb9229acccbf907efdf4091f9b9a232f
SHA512 9262847972a50f0cf8fc4225c6e9a72dbf2c55ccbcc2a098b7f1a5bd9ea87502f3c495a0431373a3c20961439d2dae4af1b1da5b9fade670d7fcaed486831d8c
SSDEEP 3072:XnN/O/ceJkGwg/MOAibD2hPfX4HYhDhudcvObkSafj9:9/O/ceJkGwg/MOAib6nX44NhIWOb8fh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 119KB
SHA256 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
MD5 57613e143ff3dae10f282e84a066de28
SHA1 88756cc8c6db645b5f20aa17b14feefb4411c25f
SHA512 94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176
SSDEEP 3072:lpsQ7l3T64Z1lKcDqttEPBWVNwZ+e222pKKSxfj9:Yg3T64Z19DqtkWbu/222kZfh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 120KB
SHA256 d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66
MD5 6168553bef8c73ba623d6fe16b25e3e9
SHA1 4a31273b6f37f1f39b855edd0b764ec1b7b051e0
SHA512 0246cee85a88068ca348694d38e63d46c753b03afadf8be76eca18d21e3de77b495215ed2384d62658a391104f9e00df8605edb77339366df332c75691928efb
SSDEEP 1536:M+s43BGZsrolB21EJ4q+GIbdSW7VvCtQXjPM3mz1yxvjWRVIoFMe1V13836GKCnY:T1GZXlB2SUbxVv/zM3mZyxLUZGrSDfj9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 22KB
SHA256 c0ff9308b0e13a3e743f56ae84abf5a054fb964fb3f36e52729d78f71ecbeb67
MD5 fafd090a0b63d928fbe8b3ce4e9260aa
SHA1 172120d138fb4c6afae97bfc0bae13d424fb7c16
SHA512 4840a5455dbc8394a7d47f935aba64e5c23ee7157e9a00848a2a8bad1c604c280e4a56f9445c3c63bc0e778066dd3acff31b973521ca5384c487ea27f89ae71b
SSDEEP 384:i1jR5Tct4TfmAvJnxnhU7AbhSv8/Oolk5S8zgsh2FNoVR3VcX48kCxBCXh057mkx:YjR5TcCbfvJxbfOPzgDvor3G/RBt5lx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Size 28KB
SHA256 f60023126bcd28cf0e7afe447e9052a6b505a55c4e5ff4d2a1234039b17375c6
MD5 71d8c032980d1a77fc91df75f3b8d0ad
SHA1 6bfa8b406acf9a3572697e493b762fb5a22a4736
SHA512 cb09472205357426ea767c0759b1175e8aef801a3068e1ed70b64930d878c6debeb7ec2beff48564ae37eed6dde8b18437f0cdfde5a68cc685917447fa7e4505
SSDEEP 768:EHQL9cnk6t5zgP6kkb0L/XcJf33EgWES4uofveFB4r4uI/PBdYJODaz0Qq3:5L9Yk6t5zFR0L/4f3UgxSnmveFxuI/PP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Size 23KB
SHA256 c31d6f02f5896ddb35f0eb3d19387ed782738cc2966246f2dbb121a033fbbade
MD5 02ace8c9d46dc9bbb939e071c91e93af
SHA1 883a9db4b0e196f59758a2d136204ec7ea5b2322
SHA512 692d00d5f3a79a13bea3d938e564fa55303979a78565937b932765eb7afd621a8fb125528da39fd8a214dac7d7ffc3571e0932c9985d2201117d46cd09e2ef54
SSDEEP 384:mVwrKiV51PcM9CDeKqnDf+EX7DN5oB9ayH3jafoSxxwBf6FsqUTAZuEmdCa3qGYr:akFcMgDqDdX7DNIVjfBAsqYAZulnbY9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Size 22KB
SHA256 cd736da48dba022636df45d58ba50f252b576642246e53d6f685c8bf9564111e
MD5 5d2d06e403a7a43c4f093c7c408cd742
SHA1 55863e196cfdff655b155ed2c0960913445236fd
SHA512 71b55c6acc0284d11d7e6b33ad6993f8ca9ca2186b65bc377b235e4867dc2645c4079040aa8a24482cdd35d391dc75ef7f2b7633f7197c239d8075946108fcf5
SSDEEP 384:790udmfzFNQQ6YELI0plLmlIeIw7CQ3AjrfSu/UJhDttcP3MgITrJHVRvvYGJ4GW:BdmfTQ7PlJP4CQQHquyPtck1HGGJ1iD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Size 42KB
SHA256 e86fdfeaec55483167f80ba7dc00b5b1eed1624187dc1705477d11cf55a48058
MD5 863f72ddf58c2b33e7e9167f668eef33
SHA1 67ff8fe51bab5663c9471b6468da66c62853ebc0
SHA512 9057012600613459bc5cbe6027373ed7c4455b43d751eb9c08ca2201bfa1e2852269c121d9237d42571d6f04b2d2e154439b14e257cdcc1ce3391bb7b26ddee3
SSDEEP 768:c7hvVHG/Ks2kJHlxUZPHa+p3nCy1eq9UGV9hGfCJT1KbRfHBgm:cnHG9vH3U5a+p3j9zbh1ezP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 436B
SHA256 21b0d24711b43d97b6c662b8da9aee447df864ce44935bb4e563edad97bc2da1
MD5 0adc0399c20647c56043cbc9205763c2
SHA1 679d5ead637af8c0a458c6393c248714394aeb61
SHA512 4b1226653dc2a40097f49361470d5f9126986bb2707ea14073ad37e89e2f4b4ebce75feef9ddd0c77961eae2c338672d9db30fcbf0ad4870f0a16100835cfda9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c106ab6caa706f6cdfcc3111a7886168b880e794d03eada25a53a1d735d58d27
MD5 7fba5b9815dc952bc2c6851a1100f1e9
SHA1 dbe3fcce4b199b25e92f5d54f0e6526b7b0a56e8
SHA512 3b2303c1b6046bdf048c76c80c110e95b305cb4e64e8fc3b8aded11e8c7187acfc1ae76f11770ec3b5cf6b0401ce73c5652cd114756557af0a488a55c5309f7e
SSDEEP 96:nXk8sQK8O1adl1SnwpvWMoiVmde6J3MHydXWBUWQyV+VD7AiEwb:nXkb8PaGWMKJ3Xcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4d375f1500681d4b1047d9b129b67e7aa7fbf1db69ba63a65cc2987db526bd22
MD5 09c62152f127cfc39de555b8c6229af8
SHA1 422d22518ff0cd6e0e246a895959cb844bab241d
SHA512 65eb88eeb3ea1cd13c2533351ac788965916c0fef95819d63c13cd558b64c1d98de84b3cdfcf0434b405f302cbdaf716ef273b5c251ffdfb9eaa247592d3d61a
SSDEEP 96:nXk8sQK8O1a1M1SnwpvWMoiVmde6J3MHydXWBUWQyV+VD7AiEwb:nXkbomaGWMKJ3Xcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 20dcfaea9e732d10698f54eb175dbfe0190c467a5ef108c3d16ead1b313c51b6
MD5 b7389d61a7174e133dec2d599763cf5d
SHA1 a137dbf3ff40612766d50c45783a8948eca12e90
SHA512 491b5ff9319c4b50d059fe1d324251c43c41dbeb7e7dd393a1e375777967f3711be9f14f19e01c1979a0a70f6645d5db302959d3728cf7b460078832b45df972
SSDEEP 96:nXk8sQd8O1a1b1SnwpvWMoiVmde6J3MHydXWBUWQyV+VD7AiEwb:nXkIohaGWMKJ3Xcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 962cadf880d8e80cc4244de0dbc2282bbb79b32600239968bb0b1e2f007d2903
MD5 0ccd8874c498e89b0ac0a2cf621505a5
SHA1 97ba3120a458d2c5925f172e30f157d19325e687
SHA512 c5fd73aa53c89be24aeb81a9fb3f53400c286e0dc2ca009108e90347f000c81cd8373a3de1ee8169066c60880a66d6bb1c164f1a02735ee332ff20c804dc924c
SSDEEP 96:nXk7O1adl1SnwpvWMoiVmdejuGS1jdlRBUWQyV+VD7AiEwb:nXk68PaGWMzuxhLbrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 97de0b1c05e3202dda1190194e8a006d2a7db144c6c4b8b2829fa25666f3c864
MD5 25c9405ccc10525be1ac36f9e709fa2d
SHA1 7c5a0d8a7fb14c3cc65f5e66b051e3638f3efd54
SHA512 d88ac448ecb18b3a42edd04b53141044270efd82b90a9295eed734f3611ee01078973d4931b658263ef7120a393e9e6d5394e415fc0120c2d0464b969e4366a1
SSDEEP 96:nXkMO1add1SnwpvWMoiVmdeHdwBUWQyV+VDCziEwb:nXk783aGWMX+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 87bb20e9eecbc90a1e7a107955c5bb2fc5cb02f02cd99abf084bcbe3d20cc3ef
MD5 66e7ef7df1cd58f7218f154add0f8854
SHA1 51b4176a9fdc6e7bb6ce70f246975f2e48c211bc
SHA512 0df7bd76c94f74714f4fd70c4053001cba0997dbb4cb77556099a5d7bbaefb00a496d53ba6f595cb74e985b807533672101673b8bf456556a0334368f1a46534
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59ac44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59ac44.TMP
Size 372B
SHA256 6401851f46dd4b2996cfb77ff19e7f80bfe0fc900fb9ad325db60edc0da52144
MD5 b8affa9daeff1178b16ec5a09f3fbc37
SHA1 0baecfae6e92a9d7f1636b46a985f00bf8b38d88
SHA512 0c9979960f57037164463d59539a55b8e3e415ef71b480c27ed8369712cc8f812980d46f6fcc0b1942410cd443a6b535916a3f5f2c7e93dbb7a026d1c92f2ed9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c0add1ef8b259e40335f640296d1a626e1406b0c52272a5a819dbf6b38e9517d
MD5 38586987ea6105b70031ff3492ccf375
SHA1 7b006902e0a9400801572dd43f3a646bc789b1a4
SHA512 605cc4dd61b1ba956d61ebf1470c5a99080d004e9cb2126e279379b62be1e8e872231b5a3b8bd2ea8a74f3787bc552b596fef955051513412e78f1439f09fb8d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJ2Ne2RURhRH5NYdF980JQ4:A9iIxuERzA83h09RZxYqib5NYi0Ybu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 236768.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 236768.crdownload
Size 50KB
SHA256 89c6fefdba5cba041e3c23c0e2c2cbdf62360840a07873cd753dc605f7109409
MD5 2c0c25792aa3d462ba04a344f09df0b3
SHA1 51027136c1ec1c7a6af99b0ab766e6e2d16dbe0e
SHA512 389f9427f3476773ca288edbf3a9d1d58a979a679595c33ee9abad86ea2cbd15129b581c77ed0600e81293bfe924fbc244e7237db1009d945cfbc3495f5fc093
SSDEEP 1536:Nl+Md7yPdr0sO/TGRKC9IYkPwJ3337I5I5BuKtEo17kMLWoL:wqo1oo
MD5 SHA1 SHA512 SSDEEP

Submit Download