ca22090738d5971eeefe09507f82e17f958eae1ffed175cc661cc0fbe65f7aee

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CCLauncher-Setup.exe
Size

2.9MB
MD5

82cc62b29242dcaafe424400b12ee2fa
SHA1

74b7940026ab1bbf99445958f9731ec63234dec1
SHA256

ca22090738d5971eeefe09507f82e17f958eae1ffed175cc661cc0fbe65f7aee
SHA512

08f0533a86e1d1b4f9402b3858a92a284a9e2b496096fc791de52bd9c5e6c2e5b00c808e67fb9c956923cee87ee5f8e9328039f8d79093f0872a71e9272cfaff
SSDEEP

49152:VAGNasNJnazTkmLp/w/qKP1Wv/cNwDhWiZe1n1t5Kh5lYOw8a+8F4RLQjqBN:9Nx+EmV/wTPkHcNChWik1n4hk8aN4Yq3

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	CCLauncher-Setup.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CCLauncher-Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CCLauncher-Setup.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/1672-0-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-2-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-3-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-4-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-5-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-6-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-7-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-8-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-9-0x0000000000F30000-0x000000000168A000-memory.dmp	themida
behavioral2/memory/1672-46-0x0000000000F30000-0x000000000168A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CCLauncher-Setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com
37	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1672	CCLauncher-Setup.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Gui.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qtga.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qwebp.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\qt-lib	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Core.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Svg.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\styles\qwindowsvistastyle.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Core.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Widgets.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qicns.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qjpeg.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qtiff.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qwbmp.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qwbmp.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\platforms\qwindows.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Widgets.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qtiff.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Gui.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qgif.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qico.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qjpeg.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\6KuEI60jHu.exe	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\Qt5Svg.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qsvg.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\platforms\qwindows.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qico.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qtga.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qwebp.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qgif.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qicns.dll	CCLauncher-Setup.exe
File opened for modification	C:\Program Files (x86)\CClauncher-0x76506A\styles\qwindowsvistastyle.dll	CCLauncher-Setup.exe
File created	C:\Program Files (x86)\CClauncher-0x76506A\imageformats\qsvg.dll	CCLauncher-Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\cclauncher\URL Protocol = "cclauncher"	CCLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\cclauncher\shell\open\command	CCLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\cclauncher	CCLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\cclauncher\shell	CCLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\cclauncher\shell\open	CCLauncher-Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\cclauncher\shell\open\command\ = "C:\\Program Files (x86)\\CClauncher-0x76506A\\6KuEI60jHu.exe %1"	CCLauncher-Setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
1636	msedge.exe
1636	msedge.exe
3316	identity_helper.exe
3316	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1672	CCLauncher-Setup.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 3592	1636	msedge.exe	96
PID 1636 wrote to memory of 3592	1636	msedge.exe	96
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 2712	1636	msedge.exe	97
PID 1636 wrote to memory of 3624	1636	msedge.exe	98
PID 1636 wrote to memory of 3624	1636	msedge.exe	98
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99
PID 1636 wrote to memory of 4568	1636	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\CCLauncher-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\CCLauncher-Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: RenamesItself
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheater.net/cheatcenter/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff86cef46f8,0x7ff86cef4708,0x7ff86cef4718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1770162349768228266,7670566092217719750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
69KB

MD5
3ecc4f1c256578e0dcf281eb4fac7d96

SHA1
c057d95ae240f88e9c4b556cae22567e43e5060d

SHA256
3bfc3a81a5f29f120b75d3d41321a5656678781b44d23e0767bd3e830732aaee

SHA512
7fbae0bb7db0043be68c290ab808c4591f8f6a6ea17728a98a5bcffc383ca84b51db252b933429422645f04f181f7bb95a2004b478c2f793503b99e6a664cc88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
50KB

MD5
adab4064b7cb35197d620f70b8679619

SHA1
b1bbf5e76414ea638d8310e7d45cc8cbbaf02ec8

SHA256
0033f4f8610bf9fa6d707cbae4cd822f7b9b8134d6f9b63113471ecc1a01c88b

SHA512
43a089e8f6ff13661d2ce7c64a22061815c6e5f755ff6b68bdb888aa83fde9852090bbd248498c0b51f4abb0ed708dc0dffc5906db0308132c2e2903ac005265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
92KB

MD5
56fa6828ff28bceb37bcd2fccca23696

SHA1
c8a512ae99d325cd7e55f6fc92ca71343d167105

SHA256
17dfc9ec216ae292010a33cdc73815fbaf183fbc98b8360b8647e123d19da2ee

SHA512
9ee89e601dab7e39a5db53a7f512a0bc00150d98fe18ca800ade36e8ff31a7e8923f8f33b34bd7481eab53a0ea25d0cdafe555835bad3811c187cf6f81124880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
137KB

MD5
d833eb698d5b5968305b3b4d0411dfb3

SHA1
594fe3e367d469f0ab69e0dbb76d74f122819455

SHA256
23263b68269d3c9febe459a0a1b5e0fd61ed2e8e4015e178d4a62e1fa7206d14

SHA512
a5487095bd7420af474ba594a93546d95e939855e48cf89c25b67a85971769a2276c78501d1a906e1053254cf2f370436f9173e2f8a99a702f4214bf14450e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
61KB

MD5
de88eea07eae84aeef510fb69593823a

SHA1
26cf9c9181ac9f00df34b6abf4faee271b057dab

SHA256
3002c562ce1f7bdd7bcc5e88677b67fcda891adeaf4f1913801302a1d4abc63a

SHA512
f69894bb1f2060407656eb44c22890dcf62f9b08747777f74e4a59d700749db3735c25b66eaff25e834d1be17ea739ef0bd1347f5cf18d5a059eda0c070246bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
61KB

MD5
c5974ab384b0163edd383496442fc4de

SHA1
c9428e5773a09a30046e724c43966a071e5589f7

SHA256
12fd008bb3904b45156745f01c07c50553dbafec4253eef061fa96e6dccfd704

SHA512
2e661863c9f0c3c7c270f6f79494d548aed3c9020559b228ba19b3bac8b9c924c908f9dd3be462f9ab32fee8a78dbe843be884782dbc030c9fd46e0b082e87b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
20KB

MD5
515d9959c2dd6012fab94b288eabd285

SHA1
2d46a84c0ba561200c7e329444238156c4c4bfb9

SHA256
17b7de6d77441f5fdeb838365223b0d67a7c824e128f2ff99279b5fd078afb79

SHA512
875e7222e72b1ac57a74d8c091cb8fdbd5f2530f03affc3911a79ebfd8f08a196f74041cd3796bf5fc0be5a68b23b93f129313349e0cedb26df07248baab9acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
31KB

MD5
b1a6c404864f38c91a75b3a7d6fe603d

SHA1
7eab4085b54ed9bddd1c8dbd151295ad7d56f19a

SHA256
b1d4e5e7af4a51d6d6bba076a39c44481744f55eacb284e47e203d6221d3a747

SHA512
3d7a1b977dfeb3a1f70d8ab7301c86b93fa00d06554fb40f3cc52d34547e1d5bea291ff8a678d8f95e1d0963dd9eef26aa1a1ba29f8869bd1b2423a44a01cb7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
19KB

MD5
fd03a1dd5cd005db2d9e1771316c737f

SHA1
dd357bcfeb0189409c8853cb3cbd799814585aee

SHA256
413985180322589d5d5e0caa7def919809aadf418f500f95d0dac1855432926e

SHA512
f4281fd808305d15e5d7deb3bd172d51bc1c7169a5f31327099e83379f18f164ba54d0f9aed220f1d9b4c8f5477699b22a75f2bd26ff7f6edaab840f72068e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
16KB

MD5
343ecda86bf2c56720e639fa941d355f

SHA1
25578bf93dec1b90de9acf9a4f2517d71bc81b94

SHA256
b2cefbbc516976db45adec12c098fc7b8442aa8cfe74902e5cd1782978590a6a

SHA512
d0e1a2b03d12265b36648d88071c61f6c0db9189f312724f25dbbaec826385d8397c35ca984505f7f052d704997449627fcfe144a9019272cb6a031d0413f155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
30KB

MD5
23ec69f2d5d6693fb98614ba748d87e6

SHA1
95911e88d04ee93ada634b181a82792551513c4b

SHA256
7339bd3325242c737e0f3e7ca724408f4491eef3da2ce0cff91c1145450b2415

SHA512
08e054a776efccb63e6fdf1812e83f173a0f7c51bb7652bcee17057e7d006d1e173929e048f9160a85b8de901adc381c650a45ef7933879ac6207b36542a5e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
49KB

MD5
c0d0ad5f5383b8a5c9eaedd7b8ac2470

SHA1
7c148026618304df296af9ae5dcdd0fb3866cad1

SHA256
48f40cc0d3a6e9b35cc368672a3a2da76f3ac463ee9a08efb99296c4f73bd0b0

SHA512
2e8318b9624b37cab9ebd4f2ea90cd2ca7a479a67ba87dcf16b308e234dfdd8e65e8481b01a14aad44f94ec629ce815eca49fde412af816dca40c7e5171144ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
37KB

MD5
fb74d68b8c58333f270732c2b0a23817

SHA1
976a3a8f6a5de9743a419baae07797ac866aa889

SHA256
c807dd2a50750e6ce3232c46b4d2d85d8f26255b7d80e7b0f6b8e132126811e1

SHA512
69a1d5c91694c43c02ef49c55f2706cdc5909879f006ff41cb78af0eb6ec0005521749d94f2dda59304cc3b39af4079ac60e4342188e2695739db16925faf48a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9969cbd68383b2d3a232ef0ef4852594

SHA1
c19d2b1e23f1e6bcdae565ded0a5d2ebdc5454a9

SHA256
46f374d507653b49f2f9d1209492cd6e1ae4c0c26a7e45e1d490c464a28b6ef5

SHA512
5ac4f1900cfeada9554408950ffae104ba03a36eb552b80a0a59411601edf3faf9c40fa17f04746dcdc5b71abf8b592d9b8feecee827216bc45c730680c16809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_cheater.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2b93ceada1d2aa77254c99f235d326a9

SHA1
0d5788a22258696e2bdfc28058171ff72890de90

SHA256
6394c73e34b8bb5e93cf274aaff530feab37864e64a2e774d06035c39bf18b2a

SHA512
ddf2c90f58f94a092f267f2a82432d25e760aae96bd3909f83b3009e15bbc8a11c7331e75a522edf694ee19ef13b07b5af7a428ab5776a54d186cbefe03bfa74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b3c895d55e6d262a652d0862d6e417b

SHA1
7458806c3f770b447e8e3d192fb0b8faac85cb17

SHA256
b93d2c52fcd20c7f7364d482f3206d8d38d1ad81331ccb0f130d31c817797e50

SHA512
711ab7d2d198245c1dfc510494cf62f8a29eb2fe15321c24018b7c5db6a10e717af57a48daf5ef9a6d0a8979557648505eea00a9bc0be7b5bb381858fee2ed77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99f5d944d628983072eff208926c1544

SHA1
8f0446a9a12cb40c6a0eb313b2b8dfea58f61e2b

SHA256
3490490b5741fd2580aec9b681632a243abac3000300562796cbc8e1e1c8df55

SHA512
a444126a5b5a4047cd99d75901c940c8c023e5fc617c3a706f8080f02883f1fcd3379bc8e997b922bd05805d7b71cc5e3cdacaeb84947be231b69bd2b8e36dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d00213db1d3b877aa8e14e533724e64f

SHA1
8c3f4f7c23f5667f5b0a404ecc3a26db30561469

SHA256
b7415be9ffd5c27ce9e79fbd90e578db708076f143970429641a51da8de9fe36

SHA512
dddd0550d36ad95de12c51501e29e08904d5a8aec5f67e452a71a2a29ca48b2223255a16fb282efef0f33e6689174be0596d835469fd5607b8bf549b432db647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c6daaad9696ed591d9a4372bfab737e485681248\8e04acfb-2349-4640-997c-0a6043900bdb\index-dir\the-real-index

Filesize
72B

MD5
a6bdba0a5e6f1f67c3cc6b1973192af8

SHA1
47f01f82ff8818a087bde80fe8e969d77af683eb

SHA256
d4ed46128a579bd155c7d1a49c05a2312673af893bc74ca1574363fd714224f6

SHA512
cf382f17f3d1b9814fbeef80294faf1020c105824975786243eb2da16606b022205a0f5df11182253ef87b7d53050919e8818720c0dcbc4b0fc2258574b0be36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c6daaad9696ed591d9a4372bfab737e485681248\8e04acfb-2349-4640-997c-0a6043900bdb\index-dir\the-real-index~RFe589edb.TMP

Filesize
48B

MD5
20d6c766366189292055c4a114bc9f73

SHA1
f009d36aa75cc945c52a01f5f78a3e78994c0d58

SHA256
3b7f036ba006bcd539e064782ff323abd47be87d820fc01a8ea55c625edb2bf7

SHA512
c9ba88cbf2a83dabb37aae89226f2d4dd0246c9ea8fe481534573720c87d8dfb428816a754334b45b4e2d91442100c8359068d19d09d34c6028fabd492a8eb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c6daaad9696ed591d9a4372bfab737e485681248\index.txt

Filesize
87B

MD5
762e665839ffce8ac1b016a159290355

SHA1
b5837a91f8148fe679a245d985554d9b3a3f83c3

SHA256
3d325007c0b2081bff3fc763fc8a7992e03654a7da37bb91b2c63e927c71c33d

SHA512
9c19b1dcbd44648c29f351e659b8226d6637f250e5af03e23b130dc141e7643934d1545497f4a69b8b5cc97c3a748b643ab63d3388006ba0c15dc6bfe38f30cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c6daaad9696ed591d9a4372bfab737e485681248\index.txt

Filesize
81B

MD5
69bfd3f32b62338639de272b965d4014

SHA1
638bc6046c984e5c20a2ac3fc264d6247eedbdcf

SHA256
33982add78bba5fe8f8915a40902b340a693b96d01ca753cb93c4277f8938f0b

SHA512
ef3f3ba6741aa9ae1ee736e03a6236136aa16936b7f70abbd9c1be7604534fecf005f30049625d04d31faa81bf3666274288f1a91b779099db99095040e60251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
11KB

MD5
eb89a3851681aeee57a8c0fb129aad99

SHA1
d73f9f58d761f06994c233dd03541e18112f1da7

SHA256
4b600fe025adb5eaa26aaca1ae6dd6690e451ef49716bf3de3afca3e4731740a

SHA512
9726878fb59570570df6af4d238a753dcf96902a65ad59dee2baf50cc078887378afb22fd561cf2c1bc63f61e2a4065d89ddfcad95eae817f505c3ef429c3a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ba77553390baae272f0b4548ce10e517

SHA1
60fe5156bc43f496a4a95ed43a11d8e90192a6e6

SHA256
cf50eb789f911196bc9bc098e29dac1c63b00de054c69e9eaa0b6373283de7b4

SHA512
b98c1277ffb19c4664a9b13322ba4f85fdc15c14534eb7bd26ea6cfffd9faa1d0c3122ce5889474e3238583c9e888e8e6d4aecf34930471cb1a5f8d710316e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589d74.TMP

Filesize
48B

MD5
34a7d903404a09834777748cb6e7f3f6

SHA1
363377b366654a01c75e824d82fa174530e6b0ce

SHA256
7a1c3521bcec2078c9c241b32f865c656c5e724c44bfc6c9fc3388a390df22a9

SHA512
66c96d4342df0dd6550177997c782628c993ee6c6dcaefc93c77f9ea66fdbc30a3821e8fe439d537dd63d39be8c9bd4382f7b40eaa1a879ac4ebcf2e28ddfb62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e32a338b83b1dd4df83c26dd44e7342

SHA1
19bbf15b91e8d42b03d44203fe9bd1d7d0fdf1b8

SHA256
bf7664444d631a447a566ef6b6cd5b1beb43a204642aeca11c22e64ea6728a05

SHA512
583fcdc3f0594aa6b6f328da410d600955491d94b1f47180d407e4b5a3589f66d6258b501170ceaa72f07298db6d1354bda01422a7c1f886da80148a62f42ee6

Download Submit
memory/1672-4-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-3-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-5-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-6-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-7-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-8-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-9-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-46-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-0-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-2-0x0000000000F30000-0x000000000168A000-memory.dmp

Filesize
7.4MB

Download
memory/1672-1-0x00000000773E4000-0x00000000773E6000-memory.dmp

Filesize
8KB

Download