hxxps://ssur[.]cc/gamex

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://ssur.cc/gamex

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395712074"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1321309693"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31044289"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044289"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00b2152c1b2d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052a69338ef97e94eb4d938c2816c6e0d000000000200000000001066000000010000200000000a578c9f55c9bfe4f3f695dc43b4e33601bef55d1dfaa591fe675feb277d1121000000000e800000000200002000000017f95132bda73239088b09f91c5b33b4774ce148ea14628dc627a630c5ec5c61200000002e445c96e4a6d6dfc1baaec4b49f2e74f8353b7519e272f4aea38d9afe3a70b2400000004834638d2c1ec3a66ee667acf341e6f0d42ab7e0753a305a69f9f1349ae416d46a1d5bdd5843842cb51356a9064722a4f5cc53bd15f7a0e96f8bda344036aece	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052a69338ef97e94eb4d938c2816c6e0d0000000002000000000010660000000100002000000003aad939fdb6b21882d93e65240a593afc6d6d8ec47c1f3d69dc4ad47bb60b36000000000e8000000002000020000000b5eed66ac60ade884a76a1b13bc4c7485e0cdef9a43b3345ff13ff572bf01420200000002f02c6cb37f61a8e048bde01452a68084211100a6493850496e0edd2ebe553484000000025dffb85bd216893e4848f8da97e96162bd8fc8eadc968daee78f16740cc9186d3a11124079cfa1cd3285f84ddd8bfb9145305396c04b8f0ec2a4c6fa04c0dcd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044289"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700f1652c1b2d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7A37421F-1EB4-11EE-A95E-DAC42FC89509} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1321309693"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1331462212"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1722984668-1829624581-3022101259-1000\{F71BBDB4-5A81-4010-A33F-B907D7F4DD36}	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
1328	msedge.exe
1328	msedge.exe
1588	identity_helper.exe
1588	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4812	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4812	IEXPLORE.EXE
Token: SeShutdownPrivilege	4812	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4812	IEXPLORE.EXE
Token: SeShutdownPrivilege	4812	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4812	IEXPLORE.EXE
Token: 33	5000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5000	AUDIODG.EXE
Token: SeShutdownPrivilege	4812	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4812	IEXPLORE.EXE
Token: 33	4812	IEXPLORE.EXE
Token: SeIncBasePriorityPrivilege	4812	IEXPLORE.EXE
Token: SeShutdownPrivilege	4812	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4812	IEXPLORE.EXE
Token: SeShutdownPrivilege	4812	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4812	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4072	iexplore.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4072	iexplore.exe
4072	iexplore.exe
4812	IEXPLORE.EXE
4812	IEXPLORE.EXE
4812	IEXPLORE.EXE
4812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4812	4072	iexplore.exe	83
PID 4072 wrote to memory of 4812	4072	iexplore.exe	83
PID 4072 wrote to memory of 4812	4072	iexplore.exe	83
PID 1328 wrote to memory of 3120	1328	msedge.exe	92
PID 1328 wrote to memory of 3120	1328	msedge.exe	92
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 5116	1328	msedge.exe	93
PID 1328 wrote to memory of 3600	1328	msedge.exe	94
PID 1328 wrote to memory of 3600	1328	msedge.exe	94
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95
PID 1328 wrote to memory of 3940	1328	msedge.exe	95

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://ssur.cc/gamex
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4072 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x3b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc7e2246f8,0x7ffc7e224708,0x7ffc7e224718
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,13913028871713670353,18403569686375375078,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Scanning

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
8abe2682397fa9c3ecf0e5d6895ff47c

SHA1
6aca359966f6080ec5512ee019768506e2728ee1

SHA256
6fdbd2ea5537ae2599aca7b31350b6f8a677364072a6df5b5a8665148d040930

SHA512
8ebc765218f54bfd23b1aee99bdf501617cfdc56a1d91f7ed0c9437ca35aacdead8a5bb4b605c2af83c69b4d74408a84f9ed7e69509966a4a33c6e0c97bf60b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\968E1ADE20CD22F121B79D04DE17E0B4

Filesize
503B

MD5
9578bb559d2da675833f6ed4044de9f6

SHA1
b73c25c13b74297f3838f23cf6078c6ba02a5bab

SHA256
e1a890ebc7bfee063cf50719985df6f502eeb2f1cc229697eac01010d9ba54af

SHA512
87f2e9853f0ec5e8a6b88c550d5d6416466af1208eef64b5d5c609ef516cd18d46302407077b991a8af66e6f47718af15b13e35bf0cabef29eb99800eefa78b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
6a2656e4233ce3733edfbf39a98352e3

SHA1
b0c781597edac58a20e84cb3de6541048e7c7c74

SHA256
bf165407f64eee737ab90ebaaad47207d15b83ab5ab59494efa96a325d07e58e

SHA512
b5b056c76210a5474ac5c1bb7400a3e1ba334febc7673cf885cab9e3e0a643fb2e740e800dfc3caac698542914adfda9a18f54b60db7962a23a31d915a88a51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
cfbc16e33dcbef6f773f0f79af528f45

SHA1
ecb8d5e8107bc671dd57fb2a137c00bffa419f1f

SHA256
f0937890fb1053069baac97b7992c6d22cb74cae20317fc05d51070d96950ffa

SHA512
59ac2ead1eb84edffb06867850beb1e63f72c5b5415abd2fd4e7c2a1922c368f612d2a0288c00e32d5da47c4a77968ffbe72660a8d1f577f44fb20df9c11a4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
8ae6977d1a22eab52a149e382e2c6412

SHA1
b8708018ca37b81e72ab893a8806d39fc7319c58

SHA256
a8143213e1e66c00c5c21fcb118ddc66f9eece55469092790d0c0193271d33c8

SHA512
6885b9678c0eb23a7c9ef6cb84a2c6c6414d238ed095df77faf25c9dff1caeefdc7155590ded8c2b023f9bddfe0f72ab8f0b1c512c2d1d8676c3003e660b73dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
d33323f982ab9e21b31287a24dab90ef

SHA1
32893e20427793e91b710078dd4cb1f75593dc68

SHA256
40d150d0db6d72fca25a2ed1cb37b421cac87eb6b2089de71e0ccbc54b7ec7d8

SHA512
09440052d4049fb593cfab96a20911262cc8a31463e3b776ef9d974b0bc3be3099ec81e23f751cfaa9ac73a363139a1591c57356dffe38f7465439244dd57065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\968E1ADE20CD22F121B79D04DE17E0B4

Filesize
552B

MD5
b934d07dc88f26ae745f6d2aed82e8e0

SHA1
bdac6a16bf01438b8aac969f21802d534f3e1fff

SHA256
c9f3bba7b5845a4b58b76946c5a4dea913dbfb1c351f1c7b983de54c80160ad9

SHA512
8b0d6711da937798531e73254e7b758120ab47c1cd7fde4f75e35c39371388e262847273cd36b67a17cdf62356a5c48b3fcced1e505417cb033dd31ac073ebff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
5c5e5ea165702add57390366153c45b1

SHA1
b4403b4d4dd9749b37c4a24af07a9138cbf1d1da

SHA256
2fd66d9e86931e2ec66d751d4f7971e379b156ea5aa4c2971f3034408cdebba8

SHA512
0cf3b84575503ee579cf48938705c4166062262658eb398f2e56489ed24b8a3a0612dea85eb4bfb1bc2c1e7f533709106969233b11be05342c08c33a3ece00bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
30b88ec06d9c9e320ab03afc3fffff02

SHA1
e314f22609ecb7a2c1e84d9761f9ac294493de4c

SHA256
13dd749b1a32460c85fe51d7388c586bc0dfb32475cbaaf70e14d47db8ddc342

SHA512
3b8bbfa83aa7059d6f5aa49f5b11066a70ed719f816716c9b76e9cff2c7728ef88af60a4a01dd89ff4e21ffdd04802b5dba0125ae35af842d9863c6a17858b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
1024KB

MD5
9f4dcbdf04e64505a3af708837bd8ce9

SHA1
a36efb8e36b784fb4d5070d87bd3ac471ff954fd

SHA256
312610a38cf23c6cbe43c087710c64cb2b301877dd686e6c918feffbc893c0ea

SHA512
ee8d058d5af9adcea35e46aace52a4bc74915867e2b6c1109763613c8466ec8cc78ec13b587dfc14eebf972d8ca5cb30ecf6b84ccfe2da7975c9251ef883adc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0153dc9dd317c5882e974e601a8b1c45

SHA1
f03d37f4802f6ec50af0c3168695e36fc0bf566d

SHA256
363570cf9254a4944a0cfe94d317db8c1b5e38b2f896357b3f2c4d21e577e034

SHA512
a194358e62459a151c31fef13d25f9b7e83106a17476e37c23e913a968e2bef93e9272c134a66e05693f00e74dfbe5911814f8ac3259a6bdcd817fce1767a2f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4bba14fe8a0e261d47ca52126ba832c5

SHA1
b945445e216a191a4a14dc9a88f3847a6ad349ca

SHA256
2f5e177bf1d02c956c5eec831b9e5c3ff66c051f3406840bca9dba4311427e33

SHA512
ecfdb1175967311d0b0bb1c166aa33facfa942a7a1eb1f1cb770e21f5f6a8e2b99b96a75afa5d996c13791074f9a9946732c388b077ba0e4a10bf50baf964aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9141a3327ed4bf7513c3289faf112c48

SHA1
a1689e55adb3b2518f47ac0babad8c5bbcdc09a0

SHA256
5b462b11051cb49c07188574afdb6aaf0343a8877b6ea9bd6098e68793519aa5

SHA512
3e20a6d3d4d1334e7bc890a7fc180f3bc0fe056063d61ac440b136e84ccc67617ccca9b0e9bbbcea6aeead7c9014bad2233a74f0414a33f7e953de15fd20ee76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fadc3a5801503e5b4e96c97e9e092e66

SHA1
021732390b34f7ec6807c0b8048e626247e263f5

SHA256
c85adb83ee60acf28f448d4607fdef64f5170be4af9e8c75b8229eff021e942f

SHA512
6b8165eec8c7ee18f2558dacd555c398f8c398d971990e165e1fea2a8ec9ff356fb61351e8052b5cada5cb1efd00dff59919c7b8f5880dd4eca8144e5272eaf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7c587c4039386f29cbf4a6b67c125efb

SHA1
ab276c8c25763264b99e622030fb1d518d4c2dca

SHA256
f1a194c948fe58503be924828c0c55f23c4ad0cb6b8d9c9ccf614400eaaac577

SHA512
14d2c9ab4e6d562063dee6088e83b67339f974fd6cbb1c7cf5f5daf1ba573973fb78829185ca335045c65e66b379976ee7db2bd8022346f93cfee0b914f1c9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4468400783d92791c621ff01894a2637

SHA1
c7f16efbf967d029b26ff6310d7f6ded66624ec5

SHA256
9b9bef9d7d0b2ebb744d1a7b37511184bbcc87ee1ef8219754b8831600cfe68a

SHA512
fd9a65f4b6e9148dea1d0b0d3ce67723e51de038398a859b5fcdc3ec42405da66bad048e6e5ffae065b406b0e38a93f70a5b23eae8c2deafbbf46cc8c91c6553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
bb357ec58c5fdecbfc399212808011a7

SHA1
9d46e91bb3f63a7b8970636a513fac6da9c07158

SHA256
8084308a0854792ba53910f7fae6c0440097861420592000af554cea5bbb85ca

SHA512
de9812582befe20aae918c78b2ee82d4566db9d96436a0c01ef7db17f7300d4f6b87da1532d00fe20b42ab498b8689ba59cf2856466759e6f4124fe14aa8a3f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5951b0.TMP

Filesize
48B

MD5
02df54c99e3c5f40b2c0900b05399dab

SHA1
3dbaf2ddd7c7fdd4dc1bc220affae0ba1c6e4c1d

SHA256
2ece141069c322e3a59880dabee5d89d7cbb93daa1d1a56302b8b4f680422a5e

SHA512
c07dc0197438e4341346d3e95958d47c6dd6818210cc176262599f585d7517e8ab75ddd53c399d2ec94014d879969d4e668fd476d7dbce8e114a4e040b005568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4f3a1e1d105c1a8a78bf1847cf4abfc4

SHA1
5b60129f1a96cc95053dd7f3783d19a8aa67a6ec

SHA256
4df5512ca907f71adfb77c86239b48bb03e689b24e98cf96fd55e11d36d7c2e3

SHA512
1d447e82378e9ab7712abb46d6833086cf99205903fe47fc8f744f19212c7584277a4c6e5a18c3a4aa039021947a6ec2d3b4c104f0329367d91cf8d8836c12f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
666f5cdfcc03de99694d553b013e043f

SHA1
274ad775ab2b51d22b6d1c512a79dee43d99295d

SHA256
a32da301af06f6afdc534212c442e5ba18149c7bcad29c7f9369b570a99db0d4

SHA512
b49a7cf25fcacd56d168e2d0a3a8adc2264bbac28e4b9903d1b2b66085dd78cd512c512e0a7fcb6ee33fe2a9676fda7b368045c630ce25a1b06b6c7328bc75e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5amy22j\imagestore.dat

Filesize
4KB

MD5
7d396deb103472b50575f53272d96ea2

SHA1
3dda43a912ac32a0ec23ed99b35d7dec7f432ded

SHA256
919ff792b6631d22001cd479bef5014df378beea597faa564fd716167e251b55

SHA512
0834ca82dc65f1a3c16910de64809724d8195770c34f9ee44685ea807e1ff4bd93fee498381d1456ff407b455e5bf25da3090cfdc7c8a4f7b2a6a6091890fe93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\34SFYBWV\favicon[1].png

Filesize
4KB

MD5
4cdf3256cd7b8ec3917adb79d6bf457e

SHA1
bc615337e9223183a126c8fb649774866fb53e69

SHA256
fbfff44a653dc193b93620f1035d221d3aaddf3238742270b3385482986ef7f0

SHA512
2bcd90a667b80393690e244a979e36e9f482b419e52302571a41412aac296aac1d58f81787b38d00a00257dca8bd3dce7cfe6ab8ef12aa3a91e0801ee3c3f21a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQKW7621\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF82EC9C23BCB3327C.TMP

Filesize
16KB

MD5
e930c0919b7334b8f93ee8e5303828a6

SHA1
2b822e64ff6b09ea8519bd8b4c8802162c05c112

SHA256
6f63c39f465c1d966a9d0ad709c1a0a15b629ce9e80778529aacb91413a0689f

SHA512
c2432eb0f94f0a87173bffc18e640a706947faeacb9746c3062c2931b2de2c2023dff231f642f87892385ab6add955b7caf7269f6e547dc3fa5d5e2f42321751

Download Submit