hxxps://l[.]sourceforge[.]net/f/a/XemIPV7dtGgMJeZTYLfURQ~~/AABcDgA~/RgRmjyXqP0RaaHR0cHM6Ly9zb3VyY2Vmb3JnZS5uZXQvcHJvamVjdHMvc3F1aXJyZWwtc3FsL3Vuc3Vic2NyaWJlP2VtYWlsPW1pY2hhZWwuZ2lsbGVzcGllJTQwZGtiLmRlVwNzcGNCCmSlavKtZIie76xSGG1pY2hhZWwuZ2lsbGVzcGllQGRrYi5kZVgEAAAAAQ~~

Analysis

max time kernel
62s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-de
resource tags

arch:x64arch:x86image:win10v2004-20230703-delocale:de-deos:windows10-2004-x64systemwindows
submitted
12/07/2023, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://l.sourceforge.net/f/a/XemIPV7dtGgMJeZTYLfURQ~~/AABcDgA~/RgRmjyXqP0RaaHR0cHM6Ly9zb3VyY2Vmb3JnZS5uZXQvcHJvamVjdHMvc3F1aXJyZWwtc3FsL3Vuc3Vic2NyaWJlP2VtYWlsPW1pY2hhZWwuZ2lsbGVzcGllJTQwZGtiLmRlVwNzcGNCCmSlavKtZIie76xSGG1pY2hhZWwuZ2lsbGVzcGllQGRrYi5kZVgEAAAAAQ~~

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4524	powershell.exe
4524	powershell.exe
4844	msedge.exe
4844	msedge.exe
2076	msedge.exe
2076	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
1012	msedge.exe
1012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4428	2076	msedge.exe	87
PID 2076 wrote to memory of 4428	2076	msedge.exe	87
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 520	2076	msedge.exe	88
PID 2076 wrote to memory of 4844	2076	msedge.exe	89
PID 2076 wrote to memory of 4844	2076	msedge.exe	89
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91
PID 2076 wrote to memory of 3836	2076	msedge.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://l.sourceforge.net/f/a/XemIPV7dtGgMJeZTYLfURQ~~/AABcDgA~/RgRmjyXqP0RaaHR0cHM6Ly9zb3VyY2Vmb3JnZS5uZXQvcHJvamVjdHMvc3F1aXJyZWwtc3FsL3Vuc3Vic2NyaWJlP2VtYWlsPW1pY2hhZWwuZ2lsbGVzcGllJTQwZGtiLmRlVwNzcGNCCmSlavKtZIie76xSGG1pY2hhZWwuZ2lsbGVzcGllQGRrYi5kZVgEAAAAAQ~~
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://l.sourceforge.net/f/a/XemIPV7dtGgMJeZTYLfURQ~~/AABcDgA~/RgRmjyXqP0RaaHR0cHM6Ly9zb3VyY2Vmb3JnZS5uZXQvcHJvamVjdHMvc3F1aXJyZWwtc3FsL3Vuc3Vic2NyaWJlP2VtYWlsPW1pY2hhZWwuZ2lsbGVzcGllJTQwZGtiLmRlVwNzcGNCCmSlavKtZIie76xSGG1pY2hhZWwuZ2lsbGVzcGllQGRrYi5kZVgEAAAAAQ~~
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9dce46f8,0x7fff9dce4708,0x7fff9dce4718
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --service-sandbox-type=collections --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8156 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\squirrel-sql-snapshot-20230711_2338-standard.jar"
  2⤵
  PID:2744
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\squirrel-sql-snapshot-20230711_2338-standard.jar"
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1196 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5168 /prefetch:2
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3680334230327147304,6915875289798104354,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:6056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
84cdc9d73ebe7eeac9c72826010f4287

SHA1
857856d9ae8e6a6d9a9282885e6d1f31b8770462

SHA256
b027e21790d21b9278ec40ddab881048c2943f34df79c6be38119faea2289f8a

SHA512
bfec543fb26da3c67be5db52f39757037960ce6b0c8a63e90681c1c88cb0ec8d1eb74145194aa6487ed80cbe749b65d81529fcc1fd5a4a32cf72bc7ac2df661d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
61KB

MD5
1eb268edc0875db10b862ef07d8d8d4b

SHA1
f2bde48caea75293346f8c5fcfbb64df65560851

SHA256
5d42d9554a6e207d879b5d3f272366f9fe550182ea706bbf8bff931c0dc6410d

SHA512
83523466218f39fb755673d94719e5fc3fa3534a35b932d0948639d7a4db88f6ebb0abad1873a891a37dcb3f33b30c2291a667dc97cbc1141a6ab9d8b7b987e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
25KB

MD5
15c4fc3ed81230b025e4e3d3a27fe379

SHA1
46e25b0b0f8f0d5e29358d2d523e58889b76a0b6

SHA256
adfc4e0c1d91b45825f64baa92654dc248e822b5c328909750503baddbf88575

SHA512
c129453b4b1338f157bace6add90d7d237f785557a1bdd51ce213ba3f916a7dd69fd984a61fdf6835235f651bfbadf0effcf25faf4079911d3b4ac098aad220e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
40KB

MD5
0a91f06929f16d4847a0d8991566f679

SHA1
de70e57f97e990d8e91e8fe178250e35c5ea95cb

SHA256
277c3b08e7956e0f7fe2cc0ba5368d3167e77960c70c0271be8625396baf714b

SHA512
0ddd7c7e1afc0064946fede53e32e33d17347e3412299fe5e5e3796313a63f512b6cffffc4582ff45b81d815f1a866aedc5da5a4c6e409f6c9b7849bfd5dcec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
124KB

MD5
8c2c0a84e22cc004d2877a47f741559d

SHA1
82e665a6b706da1739b28512e8687f0831bf5df3

SHA256
1d883e92560b13726bffe6b4be4786f9dca542426479293b3904af0252b3d07c

SHA512
1cd99b2b9d5883e0f368bb83a354d2e9e2e9bb6e144be41134639ae28b73a3824db4153110b738b54d1dd15bed30589ef03aa76e7e85b100fba00407ad7b9af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
63KB

MD5
34d5015941e4901485c7974667b85162

SHA1
cf032e42cf197dcc3022001a0bde9d74eb11ac15

SHA256
5c166a5d40aeefd0679a14f95e47ff28824e66abba82adfa30be41803cc25632

SHA512
42cef1d6847f535a6e8afc0469b9f5ef79ce4ab21512ac7eeda8ef9667d5f24bb33b30aba9a29824b3d853d41d4addf6bdee2042cf4fbd0a033b61657c671f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
82KB

MD5
0738369ef07767ab210bb86620e67be5

SHA1
614c13aab9d15fa34b775bf2067b79843d28a878

SHA256
0d4e0fd138dc6b3c2083893cdfa826d2159297e939442ff62629082d58cabd83

SHA512
156e20b8bf77279cff6fdca6258b02c2883c22386725adfa1bf49e7f81266137c147802113104741395c57ab1f2ec464c1c109f0f32ad30043b9fead3f4f48d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
31KB

MD5
d9b47a1d9e4d651e26aa244c5dc3c8f8

SHA1
84daecacf953f780bdec29c6575a207c7c764a8f

SHA256
0549a55cf8295b41e723367d3d31da92b124ed47604207a86ae3adaca230813c

SHA512
f0755bd166690003f5308d53e555f5ac18c5a63032754bf06f75786a7f81b3c4bac92cc00cd34e0f3b8a30b8d9b485b87309c301325f4dd9c31234a9925fd9be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
67KB

MD5
1102427c65e15eba503b1fcdc5ec4b29

SHA1
85e6df9dcff5a800963a3397e88efe48bf8b08ac

SHA256
013b6d4a08e99d86f88c342ffd5707a32a57ee6543415e370ca5524b4ceef971

SHA512
a0cf23985a4e5c73b914a3d856f91007b43630dac2b3f694ab45c3b8a14af954f8e7d6988470b8916ee5201a3c4db3f66b3148134f28f5566b22486fef0014e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
55KB

MD5
5c23395995bb584c562fc1ad3c535a62

SHA1
ac59ce53f287362d8fc035bdd8c3b9769aedfde9

SHA256
4584c477436e43adb83e36d3123aa838dc14bbb1b035e38d55fda769948a36e5

SHA512
6ed89417fbcda8da3697770b4b41e04ed669e03a22cefb3a5a1ee4bc6f146d1e4baf92c2a3f11552bd5c9daf1a90b6ac0e200da4327cbfc6c933c99aa174f9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03a89994d7b0ad4c_0

Filesize
26KB

MD5
f3850f9ac2f44ef7eba9460058d30d2a

SHA1
059d79cd0636a19f1e8cac1c0f4c81ced221c746

SHA256
eeec2ce2953e14637d9169c723082eb8a97a412da166e9ac07074ab40727c609

SHA512
32f374b5a6de7f9cd46d192ae2842f00c9a89ed2c5e16757f07dc56fee8d6e069369efcdff68ee199aa76ecee159875557ef3e150289289993d05927c9d125b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5c557df0a69e0ac5_0

Filesize
299B

MD5
8a5b95bd56f5c82aa501117158c12146

SHA1
905ed9eb81fef5c93bfbc6a7fbe1cc186f7e708c

SHA256
bbc7707d6eced8164b2d7d91fed098ce45532ff81f922956b6dffcf12eaba956

SHA512
9d3c7f452e6db57409c66b5e573352cb7e0b2350e535efb843746e8a3baa84414c101422aac4aab6c758497660dd172e8c5afbcd36668869abc89558b2907720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\68fc956161a21704_0

Filesize
327KB

MD5
37e00f3171b34fc0d94ee04a273044aa

SHA1
aa4ab7c1f5b3a17b3ea752302826ef83d694d994

SHA256
e60b9e49fbb12d27cd89b6ad8deac129635ea635642b7f86cc3e42bb819a1b41

SHA512
7323f562c507a2f8c759c35c57b18f96c03ad9a1951f21d4afc3e28cfc931fc5ba02c7a5305eddc0d76a7d83ef2d204b25ab83c99d89a7cf1b1e50b529dfde6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ece76cc3d8e6ee02_0

Filesize
3KB

MD5
bc3662a3c3c89085f10fbd57a7d064b7

SHA1
e663ef09e0a8ea58d3d417c060b557e27ca75921

SHA256
bd8da17c95ca02a5feb5cec7cc279b7c56d9637a28c30da21c85f98d4611f70a

SHA512
b2e24d899a8c07f754aa66ed4929f798fa216d040c15b2151a3697915ca8b370ad7dc288834260757f866d89af7207b67de523597044d25c07f513c8d52b538f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
9635804036245310fb94bc440be19e47

SHA1
c71ce704073456a14b8edcb924a832852d13db6b

SHA256
b1bfd7f150d07a8787f3b73669894f9b0c0c933b56ac1b6cd0820d2a9d320cfa

SHA512
108f9dbd39cdaf2c25e16fb258bbc8cf4ee52ab57375742d505fae97afb882a82140a1f36dd1101a0423001abef9f411e1befdacb3d8e6f01b2251173ae6d490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0dca66074b20ba61034902a4a2d6c8a6

SHA1
c44f8a28a7624872ef591de01e0aa9d9e3764ea7

SHA256
85d80778f2a4cfff1926342d0682647bf190ea5a9e54f61e8a6d01359abafb12

SHA512
8ce754f0928f60eb9c327b0cbe26c023c1b161f10389418d1279c6ab8a2cc31bb768d63efb64ed2586c6de14b816509b9b4c766726c43e3fe01aebed5d933312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a3e714e5f06952721ff23f24057e51ae

SHA1
9f8862d22ff137b865bd0ff21f6a01bf164d7a3f

SHA256
67e45ff1b6e7210fa1911220e7530f236cc2514a24383d6360efebbfbb02ea28

SHA512
ebf2bd6d2dee2c4f6c192f1c4d121081de2e6d942f1496424a3ea436fba6b10c609a5b28cd9377c8cedf2489c7960a0d2ce13a962f540cc1b6b957b157541cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5b384ca0c7bd2fb90651ea725f8599de

SHA1
156c01b9017f9d5c1e36263cd4f48b125e614a24

SHA256
0da6ca2f915e6f351e493c27ee4ac0bc57f9101aa6e3aef6a48b27835e1845aa

SHA512
9528fd60638a22add38280bfa015cb8313f3e8796e8f15dc0cdea2789ee5d2b07d9b4ed2b6c117ae5e164b7960edebb78bc77498c684e46f4766b1e1d77cf7e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
201bdfd9b7412149ad08c45573ee369d

SHA1
00189be47a2ac91b478e3e9535af87435a01b719

SHA256
829275c78839591d1a76ab81c329b8d74b0148ccfc7097d2f723a2031be850df

SHA512
6cda556ef0755ea2cf0ba62fe1f5ea3a884d66d59a418a3629b04288f69e9fdc3445e6742a0b4231cf9477d40ce98fd27c03acb1ae79ebd01194f12ad5afcd8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cc820dfae92c52bf33881f53a2613f15

SHA1
dcef13866e825d9bec27e91d87420098c7902665

SHA256
f91a9c65e394b62e136d1b6dfd32d1a5242d031a9a03a7a9fb8b17dfa03e78c5

SHA512
36fc9a3d9716e447918b0f63461fdefecb7070e7019e889a6b048e5da39d6079f33666872d9661e2704c0af44265119919d5b88602fb41fa57cd18ca81190682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c98308bbd56f243cbfa4bb0faab2637

SHA1
e4283c49b9c690934547e8d343e150f517468479

SHA256
915c1138cf9b668458745b0f17f02e0806fd90cdea2ec803c55e086590835bcb

SHA512
61d053e01470ba01d769331f23f0b097892f956c5d632d7594c7f10cf2c040a781fe7385b9e9e3ac2b3a3bbdecbfff43a28bf3cf231b4d49ffa510aa38be7477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d650b7ae378c5473826527fde9308cf4

SHA1
6519d64b1a8723b07efe02c64632ba437a711187

SHA256
3d4bc7677020baf42a8a0881a428aaa07c5efa98a745864025affff6f1dfe09b

SHA512
19a4b634259d93f3db6582fc4dc2a4645a64d0ab3260c2dda94e4c835b95bc9a7f1c0cd58f5f4d72c683e30121de0448e5e3aecfad2fd3bf158c28631918d441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53544457bff9ac98c00dd34a32ad42aa

SHA1
4dddd73aaafc59028316e8716100d25db00c5402

SHA256
f2a6f723902ba5e9ccb2648baa786e9b09d8c9c780bd8b6f64fb9a81e7d2aadb

SHA512
7545f85dc868ef27e93107e464a70618af48b2d968b91624e986e1234b68b2ac70f9bb2afa7ff784bce6a7eb9fd62e843fe99cfb909c5b0718bdac169a3fc88e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582a47.TMP

Filesize
1KB

MD5
0e2eb88277f077a63b3c1c631c25fb17

SHA1
0f56f721d3328acb92c316c8ec39099b5db24b98

SHA256
49cdbd86cb1d4c3f7f053bdcacc7d323e2b74739b08be229af852d66c8fdf6cf

SHA512
00813ec2a18a96ec0993c0f7e174a7a837192e47c922a665f9f2d77385f4eca49d3808db3696ab4a5b5f7758e7d35839613a00ee673fd2f2481c8bf59036a4ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db3ce7f0-e7be-49b9-aeff-3fffec2b650a.tmp

Filesize
6KB

MD5
a8a829b4f316682d7a55b41e88d864c1

SHA1
ddcada0f92cad6a243e0777de7eb6e5f6cb066d0

SHA256
e703629368c64236a8175191151033c254615643e72446b2fb4858cee11c6ec0

SHA512
2532cf8705dbd36c00bd237e1fe9fb6b871c00ca938d0ee3254bf216881798e478a692e93ce3b36e6dcc52166df95df75f6c7f7922cef79c8def9e01a1bc6738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2685520dcc7420a523fa01523529c305

SHA1
555b84b67fb90e1f254bab92caba6bcd9f540833

SHA256
70b43bb4487b8bd0b521cd63c765bd59abaefd75b8c5deb302f3082ca99ba8af

SHA512
02da5cfe87bda812854f268f37534ab4ee9aea506c848c759903ee45b9771a987a71c12e44fa540b1400b9a0118432bcf4004248401ba5d07a55daedfd2dd9c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
306c909637eccd5bf2e12e6b1bb49f40

SHA1
78a67bd967c450482c20e607b06e7e03aec5d7fb

SHA256
9a2e8be83fc59be343c2a5da370d2e4531b55ac8b76949c8aad7c1451fbb2569

SHA512
7102cdacaf662abf916f825f60ee9028eedc2cc8ba0adf2209ba8d272a4d46c889f5f02690431f7b2cc9903f8b6e6a2b65f4554f4789735309e7e63a9b2a4d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
22eedcf5fbaf359a20dd53fff44dcb78

SHA1
aa0a9b80b718aa0229d48551a1585877579e686f

SHA256
03c1e28f76142b8b25651c4a98af8b3568ae3909a15f7f37fbae0c1c21849911

SHA512
f3266763df7d9a7041adc0405b597dba1345b81c5117b3a0e9aec5f1f562fafbba01ca1226c4fb836b405d8461c9a496ad6c2b3534549a1e2e72b5e518eed02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jcyskshc.sbf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\squirrel-sql-snapshot-20230711_2338-standard.jar

Filesize
13.9MB

MD5
a047493d454f1d94cf8c95e78cc5765a

SHA1
7d957df4191728816796111046b8eae9f4424660

SHA256
9c053efdb848b3b66a709eeb123b9de447dea3394353fddcc94702991442dad6

SHA512
1d61f0961380ee054571010385c45bea77ba35789376f20d8accee5b52dec9994a4295931c5614fa2356be5dbe02bce1ad0aa228727918c257aedb35bea316d5

Download Submit
C:\Users\Admin\Downloads\squirrel-sql-snapshot-20230711_2338-standard.jar

Filesize
12.2MB

MD5
92ce5b8e606d523d90f7929d4b43add1

SHA1
3fea69b3ea5338bd22ebfba231074fde797a8ab4

SHA256
b70f34c65df0af32e1beac0ef5e66954e2a368f626bfb7e4860dae034407f5d9

SHA512
d41cd8d609a81687f03c27518c2ddf6da00b0048f5966a3f497ba0ed125401ec07e1676744bd53208d074695346145f9139456391f3587b7efeb70fac6f78f2e

Download Submit
memory/2744-803-0x00000000016B0000-0x00000000016B1000-memory.dmp

Filesize
4KB

Download
memory/2744-852-0x00000000016B0000-0x00000000016B1000-memory.dmp

Filesize
4KB

Download
memory/4524-147-0x0000023A31F10000-0x0000023A31F20000-memory.dmp

Filesize
64KB

Download
memory/4524-146-0x0000023A32B80000-0x0000023A32C84000-memory.dmp

Filesize
1.0MB

Download
memory/4524-145-0x0000023A31F10000-0x0000023A31F20000-memory.dmp

Filesize
64KB

Download
memory/4524-144-0x0000023A19A60000-0x0000023A19A70000-memory.dmp

Filesize
64KB

Download
memory/4524-139-0x0000023A31EE0000-0x0000023A31F02000-memory.dmp

Filesize
136KB

Download
memory/4524-133-0x0000023A32030000-0x0000023A320B6000-memory.dmp

Filesize
536KB

Download