922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb

Analysis

max time kernel
1782s
max time network
1787s
platform
windows10-2004_x64
resource
win10v2004-20240412-de
resource tags

arch:x64arch:x86image:win10v2004-20240412-delocale:de-deos:windows10-2004-x64systemwindows
submitted
16-04-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Acc_Generator_V3.rar
Size

10.4MB
MD5

627267770e3421378e82a76b53fd1b4e
SHA1

dbab8da0c78ac6ec4baa31ddd83b93dc4ea62259
SHA256

922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb
SHA512

320250198c93b2074e090abe17ef0daa92ee281c3d910dce8de635fce7e96f8d8f369e50da9505398ef492072993b282d5e5e78da5a2c9abb107a5e65ab0cea9
SSDEEP

196608:VJpWC8XiWjTbI8IxI46xtNSxLhKaLuM6W+mPhX2xaEwM4hvmZQN0d5:VvErjTbBdtNaA0uM6qXXEF44GOd5

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
6048	winrar-x64-700.exe
6140	winrar-x64-700.exe
5208	winrar-x64-700.exe
2864	winrar-x64-700.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 4ae0be7e078dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\de-DE = "de-DE.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420063398"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D2FF5355-FC2D-11EE-ADB7-6A78E137929F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{9BAB77A3-AF66-4C0D-B2B7-7DB2D17108A3}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31100986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31100986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31100986"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2883680221"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2811220806"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2811220806"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2177723727-746291240-1644359950-1000\{0395683C-D095-418F-9557-7C9E73C23874}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2177723727-746291240-1644359950-1000\{3B4C7212-F0A3-45AC-92AC-77035055445F}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000c9b34ce4cc8cda01ce5fbf87da8cda017063f10e3b90da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nicht bestätigt 648407.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
4256	msedge.exe
4256	msedge.exe
1500	identity_helper.exe
1500	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
5936	msedge.exe
5936	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
6088	msedge.exe
6088	msedge.exe
1348	msedge.exe
1348	msedge.exe
4156	identity_helper.exe
4156	identity_helper.exe
2216	msedge.exe
2216	msedge.exe
5296	msedge.exe
5296	msedge.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4496	OpenWith.exe
5296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of SetWindowsHookEx 52 IoCs

pid	Process
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
1076	iexplore.exe
1076	iexplore.exe
4300	IEXPLORE.EXE
4300	IEXPLORE.EXE
1076	iexplore.exe
1076	iexplore.exe
3556	IEXPLORE.EXE
3556	IEXPLORE.EXE
6048	winrar-x64-700.exe
6048	winrar-x64-700.exe
6140	winrar-x64-700.exe
6140	winrar-x64-700.exe
5208	winrar-x64-700.exe
5208	winrar-x64-700.exe
2864	winrar-x64-700.exe
2864	winrar-x64-700.exe
5296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1076	4496	OpenWith.exe	96
PID 4496 wrote to memory of 1076	4496	OpenWith.exe	96
PID 1076 wrote to memory of 4300	1076	iexplore.exe	98
PID 1076 wrote to memory of 4300	1076	iexplore.exe	98
PID 1076 wrote to memory of 4300	1076	iexplore.exe	98
PID 1076 wrote to memory of 2336	1076	iexplore.exe	100
PID 1076 wrote to memory of 2336	1076	iexplore.exe	100
PID 1076 wrote to memory of 3556	1076	iexplore.exe	101
PID 1076 wrote to memory of 3556	1076	iexplore.exe	101
PID 1076 wrote to memory of 3556	1076	iexplore.exe	101
PID 4256 wrote to memory of 2772	4256	msedge.exe	103
PID 4256 wrote to memory of 2772	4256	msedge.exe	103
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 3016	4256	msedge.exe	105
PID 4256 wrote to memory of 3016	4256	msedge.exe	105
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Acc_Generator_V3.rar
1⤵
- Modifies registry class
PID:5056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Acc_Generator_V3.rar
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4300
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\Acc_Generator_V3.rar
    3⤵
    - Modifies Internet Explorer settings
    PID:2336
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:17414 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffea74846f8,0x7ffea7484708,0x7ffea7484718
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=audio --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=video_capture --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=collections --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5936
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6048
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6140
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4388
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\179559a460e34e519bc238a7b51418bf /t 6052 /p 6048
1⤵
PID:4028

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e4c7b1e879bf4bb588a1f1ea988b224a /t 3428 /p 6140
1⤵
PID:3668

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4693d23e60874a5fb1047a7a8c1d05b0 /t 1424 /p 5208
1⤵
PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea74846f8,0x7ffea7484708,0x7ffea7484718
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=audio --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=video_capture --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a995780b8795d0c021f38e035dff7f4

SHA1
f954c6f8e05a2be26d3d5209fb14ed73bac3e0b1

SHA256
a090b2b1d0556956748241db5b485264bac67d41c996e75c7345379418f8c7ae

SHA512
10fad96de7dc1c556eb52b147a439dc6eac63e46053c3114f16bb04a27a5492ce2cba8de4bef005f56b23de9e27103e3ba670547b97fe7295d814a58a6e7f212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
7830d7f9861beac744f577604340adee

SHA1
17f1aa9de9346096c439a35e03e0115433d6dac6

SHA256
bf97afc9ccc003e56505e7d24799b9a7f50f5716e3d8a034b96f32898d5f8631

SHA512
c9139121e3d633f853c9cc2adb252d006d43b48ca4e18f6b1cc4e1b6deae56e988eff0e303712dc94bb3885e13bc3f57fdec9871347dc3d27d6210f38f0071bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f5d9025865f6c6bc30cc641e66ff9954

SHA1
aef91e4b60c011d39f3611c75dd21501c363aaf2

SHA256
9f29f8d8f2b29e1e8ffa8063fb6cf9367f80c4101d9ab4a99d766db33cca864d

SHA512
cf3185a32bc0ea06777f51b759a846f4e935dc75e984654fdd04226d4c6db97a9c1eb27ca67af729e21e87b5b07f0ad51e7c73f2bcc3afd8b3a6fd70f974ab2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
da62dc0292023382dd300a192095af30

SHA1
777837aac0fd71c4f7bb28a8e1fe27011620c5c4

SHA256
1c1f73189f180a72327444456b2d069061d6f0fcca345b8e8c6d928ce9793ec0

SHA512
f098b6f3c151e8128115c62cddf9330f01807138ffe72549513db901d8f1d1579dc2090d6e71536c7e280643cae1da052b4bfd4f33ad39b53fa3325b4352addd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
4fac925d5162e8f866f20bb10efa5259

SHA1
abe43d47c653511ad3aa4b8c1c9032ab4b1ac7ed

SHA256
e5aa782a7eaa8b1edeb6e8ac8df2694341b205981271c3359bf83f9c6896621a

SHA512
7e0f0ea29f10cde1ba1c5a42d997f3f506d91c06d1cfd40b5a971beb985776b6c4d0e2478b71ad6546d8ae86790d54a9d0a652d530ee0c3d2c2f3c8e0c3b6f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
75cab9b48632465d12ce2bec746c3541

SHA1
7c07d3537a4ee9a2416110e28cfe63238f5e3148

SHA256
550ef67e9667aafc097f856245b12828cae83614d1a4f8439c021133bc6127ad

SHA512
5a917e56009dea4a0f9d4b9f1a9a27d14c5d315101be8eb8b19eb196e44cd7a24b595483e9fe13f3a5d7569f7ba59523edc3d49567e1ee4ca1e15185c1b83ab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
66e76ccb794991420ce0f7fe7f2cceef

SHA1
bed03a3a4a78f17623157116c0284785825905c5

SHA256
b6fe0a279e75558c3b960c43ab4c5e5076b0f007319cf14a5c80b5307eff6413

SHA512
fe12665ffa97aded2d5193ddfcac22b0bdc5d42d289cff553fdd08cc81ef88e70250a1be077dcd6fffce456627d5db7f67d4788bc3aac5ad1e49d3554d4b80fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
2731c353b6d6d367c8a9e80b377e4071

SHA1
91c0e7fbb67b3f173e879931d717d34c527280c6

SHA256
2dd346ec215b683f2671115e9996974f8f5e4216dca058a01b48f4a1f673d036

SHA512
4aae313e564c1c3e8fbce93c7bcfae7d945581f0ff4b7f1303286f39983ed4ad130c7dd579af503eb4c23bede96e5816b4a37384c3fb6e9a073a923b3aaf1983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
465c135ff3f6bb6bf02d235165b69137

SHA1
bec3178fcc5f249d7d24f0a578eaaa672cb93b5c

SHA256
7fb09b9aaecbb14ee3a8c943cf1ac8616fc1d2768a1a85e7e36bc4a857066392

SHA512
1e958acc9d1f4b15a0ae159729c7a91927b2f7c7cb7a07b057ab3d0f8cfaa4f16a7f5ecb006b829a0828edbced69be94449ffc7398b6ed1dc81c71f5b52e4b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
8ee06f32845e9d7ca1d0e9156093bb96

SHA1
f08518b14d64a436939d05d9b9543a67c260425b

SHA256
0d850ceb0a4473fe3cc0bdeacec0fbad3a83c3547d996263d200fd85552aac76

SHA512
84ada40f32261136a9a25a31a0f6ea8855d7aecc79216a54d173ec24aa51300dae0ea88394b1719a1d620231ddff8f45cf408dfde4302e482562a76e0fdd199b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
131B

MD5
1d7e7bc6a8351fafae845fd050f48771

SHA1
bf2e9c6855abea368d06df73c6d8fac143b1fbf4

SHA256
311d24690a851156008b17c7b40412bf0d23588c6a68ea28fd3f775c07f21ebe

SHA512
ddb5c6b98c32a38d9488507c7d9eda85ae8d576067316bf9cc7d00bd1c127ede1665674e1cdb1abac9ac691f18878cba6d2322426dbdc8d362154e0932ce3af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
ec9fad6724983de3c95234c1e8aa63ac

SHA1
d5a4127194c1f5335fbd5be42c7b5fe7d5b016f3

SHA256
5fcdf0c244fc732e22ebc3cfd4a77ba908de8fd132d625776e1948c84a526b58

SHA512
6812667e1fae1601375d5b1fdc86b467aed9e1bddaed08ce5044cd0c0bc05fa61b624865a715033bb8f12cca5e4ad2c6aed4da1d49c804bbc7e1890bf3cc3c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6fc78011754f4765ca485d12041a0e37

SHA1
0386d08fa7627586990fb5a7af26c960e19a6230

SHA256
a6907e4c7e4a4bfc8f533fcf663d6be8cdddf1d275026071c6df2ee5a3635b1d

SHA512
c5ee3345d89791bfc6e01a1003fda391ec42996e59dee120197891cb37597f82b9918a697ed4d6d665d0348d7e8c58a917712e053d364004324b28a01ff6ef9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
471B

MD5
953450f363b1a652016a73ad7bf00049

SHA1
ddd0ab7c9d5f7026e0081fdd86437906bea82785

SHA256
9cb892884c7432a9bbbf6482f20d2c588160640b675e5c8d1e916e1eb66621c5

SHA512
57a30ff872aa6ef6beca517b47b1dc71d7a8619282a8b8f12f866c99f6246c3780c83805353a2195c489036745a4b3873bcb5710092464081039e9b5af988c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aa6a9e7d9ec908742cdb3fb9b8d8528f

SHA1
6589e0ad529e67bf54a57a9442a2bbef8f1e5b4b

SHA256
74c48f2af575d6ba7a686d6761c2df51342b65a7b8d98f122ec9bd58b43ac794

SHA512
f06d7ca9a75f3ae785d3221da92b34b8717cf44fc4154591b8bc90fc83625a4f2d67d95ba900115c4993e9773ec85e6e347e42b2299e83e6b1587f5ddffec836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
471B

MD5
5fd06b3761641d66eca9e6b7a26ab85d

SHA1
cdc1db36579e8d8d65f406db59fc3523ef2acbf2

SHA256
39e51e2d14140577978eef8f06a400fc8c468f4c643e5867249ff3ac21bd0715

SHA512
2fc110ed4307034496a58ca7b00d171452ef0aeaefccee35aa7f88b78c1fcd99db21078e87ee1d20484c2c38d1d9fc7c03f606d68e25325104e24fd7aa7f9ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c53de0b90319b07644793114daba20cd

SHA1
84fec3ca14cc86f26174d7ee96f8885016fa4ecb

SHA256
b7837213eab1a3febd9413e54ce16336893316a345e9963de4c0dc016b41e9b0

SHA512
1c39115148f7f4f220645d6821faf3a07b9e8f080f59aac1ca4794f0e8fe1a3cebe32f2cde327f73d1236c2c5c0dc80b6202b6f026184ef61ca9cfbec3daa8ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
815b9212de0b0a49cd1f166a8cad5686

SHA1
53e7b9e4f0b4ddb8a587723c804bf6d9e19609b4

SHA256
bb3a68353277fb75525669ca856997236214c35b6e41b27b74937b18a48b1b00

SHA512
d2d10736da7a7cc4d8673abcff2d4a89090585e4e752cab850020c522816616361f929dec0f7791263b727763861f1df8b221dc2a0cdb796e95700d9e38374a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b09228c7aa797ac91794c624d941cac8

SHA1
f68cb9a077d463810c45fbea9798a5d49401aaba

SHA256
26ec81dde5f8d647f405f2c2573746368f178790f022d68d7ac1bb5e76ed7e19

SHA512
1a6b6bb18dce887b557958e44f08c87d3f2171006304913f8589c6c2d05c799aac4f68abaa33e223af69c7cad300a81410a12ac282b25babdafcb05f99097f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72360279f04d06490c0e1ff0fcabefbd

SHA1
6c7af76f91cd3ab2c79cfd430cbbf9278f619184

SHA256
f3984b6df18814b325f1973dc6f339f844614e5850a04bbd2315869ad0690c1e

SHA512
1bdd73ffc17035870ffe1ddb096afea2997f418c4c2ee63c76c82821c9e34d84598c86a8e73c0c0942532a2197398d45bd322495a0d7a6d73a304e99940df96c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afa7c968f1fc824e2485bf7fbb995421

SHA1
0fc9407cb3633060848136f018f17ed0e2645cc4

SHA256
234c1118d5649f8f336dde1fe926b5447f31c6fa7fe2c5c5f2128c3e965074a1

SHA512
e36edf25824b23bd4366d21b3e45304bd6201e27d4fadf87789e9ed84c6a40373415e072c6e26dc29f3c2bf721741794e06618d8c1b8ec8c0a9609e4d8c061f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95df94ae12994a9893afe8effc10cfe1

SHA1
edb408d3578645c780770e33abb3b5261a3f8429

SHA256
dcc2425f7257fb4e0b50254051141279a1ad34e05102582b0dbd6d94b343b099

SHA512
f10f169c16933e1dc098ebe5d8f24cd64fba898f0318f0139e364ff98383a8cdd993bb63beb4176591a6c9e20fa32cbe0568e4f5ce4af29b98c8c9657f818b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6db566611406d6fa0ef39c4bf3da29b1

SHA1
4cd7525a16134307769ac262325414dd5c04691e

SHA256
96414c0ebba4c18074b8dec28b8656af2dd8cb48f6828ed6db565bbb2a81698b

SHA512
ed4a023d7c21c611732a1848c383436bfadc30595c0017237be793015e975c2a4afaeb2c8864cbfa95acee41dfde0be387f03eb326856ad7007289ed9beade72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6af2350f929c3221b9a60d51ecfd8922

SHA1
eb11279173bfbc903f49b0ef2f80d364a51386ad

SHA256
ef5df25325e7c2afa9fb22dd97a47b1cb69ff7a371dc9ca9c0d43c313d865419

SHA512
88e87d8ba63698740e09f0b6dc2cbfda15862e2156576fa3d90e75121f9e363a0f45190062f9aee477fa785fb32823c826bed097ca0b86eddaf01f5ad8a35784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3ea6a71c1981561a0b28ac37ad5ae964

SHA1
20e4ff4f8e6d80a0434372401a6435904dc1a1e1

SHA256
a6a47ddb42a52388e959d14f84d6f3ce65efaa28ce64877659b67749bffd711e

SHA512
07a2c34e8c38fd05636fa2b00b8b4a2b5f896319cf6ca916506daf9c6eb74135f1225bdb1f64919f7b4684a71d4ee2ae0d94303e863975103ba0f9b0a499bd7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
29c5a01ceecc9ce00901d52c2d7402fd

SHA1
74a571bad58a15a7fc367ef9f812cdf472bb4168

SHA256
b1cac3a3ddaaf4dcde1bc1a0d970077786304d4d5dba84dbbf9681f712d586b8

SHA512
dea88e2b4f94651d74146c73338bd4a21846b41604e029371b716f910eabc039d1c29a813f95c9ecd36a929a3bd39883c5a38a1fdb64d099bd906517f07659d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
a5aeaba667376c121fab18ef9cfbd475

SHA1
ad9fa19d634f4ab53a2d4c442cd5e6d0c6cb1083

SHA256
f29452ce7b92c1e22efe4434d2b94d30166ab8967eaad04b1de0f7b9528ce8b0

SHA512
c47e459ec2dbb7e0f941036284f323aca9f824ce8b6a0c6c43f70aba60b72ed68ca61f51c1d070a796565b710415e1f271e17562395e24ef886440824e02d68e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13357772039420167

Filesize
14KB

MD5
c84db0db6103b8c0e7e1e53fe24a3bf2

SHA1
0fa8790c640ac31291e88065ec4253e55bb18c20

SHA256
4f9d60d0bb928f43d497ac6ee3ee8c5ad83b43f2191eb9f60cb46f7d1cf67e07

SHA512
ca5905aa01b7beefeab4839173cdf3474928a1422b51502d4cc83f4f9f970de0bdc7674f43502ab577da8c2da4397eab8332cb715bcfd2cf6dafb4ce628e01f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
187B

MD5
c1ebcb221bc20c9647020e07ffa122b4

SHA1
075dd1e1888f67c7fde9c11a55e14e25ed1795c4

SHA256
aff86f9cad43c9af2a6f33195e87dccee85287179e15b12d94088b38e3de3fad

SHA512
c4c56909a949ee3f76e45b5dcfebfecb15c035e53edcf6daa326a7956ee1b916fabfe2ab1ccbbc07e49035b34a476071ac698959b9f6184198432b65d08d0047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
c7babeaae5d1cf124ac3d6a186d37368

SHA1
64ca56ec4ccf61642383889296a155e18bd34a44

SHA256
1c40c81e35a32e5da04110401ab5656da0eb5a500461d38112b31789d9c23976

SHA512
438b6900bc0cfee39cb91df8434e02ae7872249bb89a1cd491c63821074deeea86874802a54ecda38c60bd8dff51551e784e880f2c57c5380a5e4e401a68c795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
f44f3bb1a6b3c5a0d062854d38c59a73

SHA1
8550790e8a079cd22b4b38c64d96b92bdad8e3e9

SHA256
a265bb6a80743f2edd577542c72b48e9e94144ebeb36b18926d25676813907b9

SHA512
c3f3bab38c35eaccdbb1973d7f2a7be89a8bb650c96cf5513c40c12f9ac0df37d4c0981097126876c0bd9e90f3d577580c57dc7894e8c3284bd80f76890d746c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
8ef49718e1ae9f01c4010d9fb2fa8968

SHA1
151223f8c96c1af7d5c6b0eb9a223260ac7bb09f

SHA256
8d41848819b4bb259f92b6fa3cb93bf666e3791332dab2b1ab4c3fe2445ebc52

SHA512
2b4008ef5da8ee7c2d32df69e7f5df7dcc7307bce5f50fa7e78d3e389baa09286f83d0ff88ae7c51ed22f1ee5dba59329ee1d2ee9dff96cd6037982d19d909cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
215b974d8919db231c370288d744196a

SHA1
8c374e6c868a6ebb37bda601a3913e02d7b07df2

SHA256
7ddc23d9ba7279586ca187220a5e35ff0659df4afeb4dbb7b83b35567e5e0943

SHA512
3ad6f62b9361c43abcb953bc44b821d0945c344d2e022a559656ad9935f4c8fde128cf989bbc7eb9295163f7e99a38c5654a16ec9c67c14c39c9fac535a24e9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1595fbb59f68f92218b4693075fa5617

SHA1
d2892cacf9d025e9d72636286842f11275a4a423

SHA256
d4ce5b768fca484c88164cb8dc2f04cc9cdaac0b539ee05285bff4aa567c6cd5

SHA512
a5dca1be77a51f047d0e383ab4669ad8c05aedb17cc00b04d21efa83a1c6787a83714a1d13d008204ae2698a08565187f48cc08e1e670da9e98f92083fe0c266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5299242727e66dd393d7fd1aa28f0f76

SHA1
41b88e7617f3932677605c80999538b313437c34

SHA256
620c4bb4e69f608018622903ec3661cdb147eca0014f1c4def1b9287e76b728f

SHA512
99800ec63024760fa0d50822264e080d4db47e822d45c3076581c3d12bc798d058caf3b55ab6466d5d25450210b3bf05336466031e11dd1c015c4fc6701faa80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4d33af53a9059c0d153d91efadc38d22

SHA1
c1a627337577c5b41c8fc0e56f01261bfaf9c1a7

SHA256
66eb66a0eca428fe404f9a332526590019bcf7cbc3916dd828dd4682d00d1927

SHA512
3c4226d00e1d5870c269b85ad718d49f1ab3660826faccc4d71af87283d6986453e1fa8e638611c2e6729140b9b7faa0994ec943d4b9bdd7ab29f7b18721ad1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
70b4a4c4de7f7b42487d28321c96e4ff

SHA1
38545a4def61062f9202a220968d62ff22e7df3f

SHA256
3063cb8d07eb02c0614bfff5e28594a4cde8285f74e55808d28ca4907ccb9737

SHA512
afd7acf7a238ce5bfc2ebe742a51f5a91148ed337bc1d4b6977619c9be963a71882919c1703b2d34270057da3e7645831076b8be1bc6947d85f9c305eedc4ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e84.TMP

Filesize
705B

MD5
e244df995a94f864ccf6c98d9aab8c66

SHA1
4df8a89438ba750fc2bb2043fab8051ea7d54eb4

SHA256
ae499849014598f72143aabc542679e7c818b2e66ae658e32f0335662afab663

SHA512
47f7993087e96871e3441c320285f14f4bb0bb6bb7c530bc3cef866a254865f39845f3af8d8265bf99c323d474263e944425fd2518580dd997f55ef6fa6c65a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
0f019932339e72b60d1ba685eed87ca7

SHA1
9ee093c9607aa476a8f950583e2bc2819fc57bdc

SHA256
f57c10b9841c2a6c5c774b222888686a188d05e55ed2c733942f99e7994d860d

SHA512
45a45f7e6eb9b92380101dc858a5e39c9847bc2a95b95335b6cc6d29442c69d490617dca4654ab01d244933650442b249b4a6fb404860e75f45768cb84d9ca4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
e43c5f79885b94316194751e0c41e815

SHA1
5d92eca3e00251e2185a621d33dece476372b0d4

SHA256
abc47722e90610f5d8c634859e1a471eef78b3c095279883711819e8edde8b25

SHA512
ce2dfb7a9d8ab23a6c211abfa3128988348404bf1766d676f81df5641950958423f352c76c2f603710bdce703601ec35e9eecd5d12545ba56b7ca04e774639ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
1dc9bb06c315fabec14fbb37f14338dd

SHA1
ed41afab51c877805809b7ea60937429d70fde53

SHA256
7e9e3f24e0df5f11ff4ce2a782c822ec5184d1f5a0b8543167b7abb64e941058

SHA512
be87d0910be182712c11105b98f6b132f428edf0b6f6e3848191dbfb4624d728bf391834f037dd7850e0be19b4ca573f1592c0b7192a6a6f1f08b74b404d8a99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
91KB

MD5
8f058ef1c0d3b58b42c59d71478b0aa1

SHA1
c3d79a7be25ac878a16055a3708c1db5c4e2e210

SHA256
34d8a314031a24cfc736f8fd7079531d29028ccbb2c9bcc64565baf10e240d12

SHA512
edef3ed1deb3003605f4b1bb5735a3eb5b14ba38107c36a06d3084f1009870ba5621fae3566231d0fc1eb9d8255bb954b06aa89ff66d445336844eed9d1106f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
98f8033ee48e9147d719f0e1a917f220

SHA1
b3714f7556acdfdc71827334fe90b2c42625d312

SHA256
7009d8e5eb7e10abfd46d418eebb9a9030e09a37c667fcd755d1cfaff89a1fdf

SHA512
9af9870637b17f1d29a1e07d0cb55f3f0ab1d74ef40d33348fc9db67bdcfaea74726ad9746a0de1da22e45b0ec4c96bb1eacbce4741758e9f95fa31b9ab1d58b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
79f13216f5be81b0e609dc95f9661ab3

SHA1
ccf40bcc2a732f85964c781fb440d66f2e0318fe

SHA256
3ddf0e7d2712862b85a23e0bcda3b8fb8d8e3a177c63ac81f46d068e19c1ecd4

SHA512
526a2d0abaa5974177b04d68458af07100b134a6546cd42769a39d78d1d9423b4a7c4848334856844f7d825334c917ebde32d7b0b7b1df5bcc79b83e171a235b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
8e39569840f33b357d9003c58b1e159b

SHA1
d6748c1380f601e16d94befe7dd15266fd71617f

SHA256
659adee81eb0f83c23fd3b129d80caaa4a8b0cb7140bcd385d5f7e4a0d4eba85

SHA512
3d5b6f5deb9748b08e59d79e4fc3768e40fc5cc1b33c1ec3d81aff98a15eae9024ec1e894cc4fbd9c30ba5643d1f39a6111982fd4afb4a138c1006e5acc64113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c543981222f331e56e2b7b731e44c1c

SHA1
3eca7408cf65cbaf8942d557bbdd792a39333c24

SHA256
c317df6391c6c349ca0a067b2e8bf4399e4785576f75a5be77030d1971fc9797

SHA512
fa9c475b1369a1e153554e271189e64be8b2bbd1b3a66cde454408f6b6e3f525ac12d75b4ab8438cf397e115d3e4eb2190bab27e8892f3c627ce5ab892fc9a98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a2025e97432955ba8f00ceb9b7544575

SHA1
d9e07a425f9b74135e9ed31ac42cc1d53383313f

SHA256
4aeb0202a5ccb615f4b49f59767a7fa1c15faf3bd05898f9423a3d50dbdd389d

SHA512
468767ac1bc194345c1fe4e65ee824bbe97a599e64341a236fcd672e1f3244ea419a74f8522f31a2705911433214b9d9974d47214d7bda50971d44dbd9ff3a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7c0ff796bedcd725798e1d6e26c809e3

SHA1
82d2228fddcd41a8bfd01e09702c7e343a5c3938

SHA256
75ba341c6993a2357d3cf7f0354463f0559e8d549a556a1755a92dd36b3b3ac5

SHA512
f4a3a64c178b87c6df8e253d66bc8b204891dc0b3e33c6c19efe0e9ad276354fe8b6a7315c2fc75a68384af6e0022cc0dc5a0ef17163ee8bd6f302effc864b7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
320e34bf5705daf6b62e563fb5307431

SHA1
9c7e87ff981be5d3a0eb38fdbe8bceab5e80445d

SHA256
9452db79c1072f00681b067a8f6e965945b46aed675aeab061d48ea0683e9656

SHA512
bc2a542800878e99d72f92664ca25aea0b7116b0a82e8f98f8e6b5e899a8b21d193eba5371607340177098d6ae6d70f30ce01a75e7bebc7ab4c868ce9078570c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f85c2954552164d566da3d1e1e10525d

SHA1
3ebea86f57879c51ca8d9958b6325201b6178cfc

SHA256
ab264884940ff6261397b78aace0585b2f017b1abe549c5ffe0646d2f565a59d

SHA512
4b773545b1c86cda6ba794c1fde969e6f1338d0a8818db12d77bc9a27e6d854f28e414cb55b8fd71c0ef2e0e0884aa4a442dc25b4391f36fd425b4d5c3905abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
5ae93df0ab102f28ec5128adde2889bb

SHA1
a7dbaf27482b0fc41f4e906f2eaabbc5dbe191b8

SHA256
716f9847778ca18f1a099a93430f61dfca74cfeeead7f933f40f6025e814d987

SHA512
8903ac2243c1b412d7030e760a1c27e4ed0bcb216bd2c8621a4b76bd25590d72a9bd11213ef68857b0cdc30103de8b6e8d912061c6b0f011dfc50e1bf98146db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\de-DE.1

Filesize
18KB

MD5
cc5361b5fdccfc6830217e2eb9972dd8

SHA1
e4a1206d9190eccea3e6a116c954d11da0aeba66

SHA256
afd57b0b6d8166e25bbef7cbc97522677c11c9a930fd4d4a204d1b7ae6258492

SHA512
ef63961bd7f0d3357d352a8f9c8ea57d0271e0fb664b1be179c38cd2d559bbaa4864f64f3521f26f868cc074f97994e2658c6d652021a39dc5207d45411691bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
7d04612795081c4f957f395cfb3f3262

SHA1
3f2992c224e965e926a415eedbdc78cce03cb441

SHA256
239dc9ecc3db30f3418237acaf04843162c261eaed07323a586f48d0d8be4182

SHA512
71f61f25e147e9201efc24e8833f2ed1bdc67e4734262c4ec1530b59a0783f13df13ce2800d29c6c6d50c1f916db2d748c16c85a53dec0a6d6800956fe8e9825

Download Submit
C:\Users\Admin\Downloads\Acc_Generator_V3.rar

Filesize
10.4MB

MD5
627267770e3421378e82a76b53fd1b4e

SHA1
dbab8da0c78ac6ec4baa31ddd83b93dc4ea62259

SHA256
922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb

SHA512
320250198c93b2074e090abe17ef0daa92ee281c3d910dce8de635fce7e96f8d8f369e50da9505398ef492072993b282d5e5e78da5a2c9abb107a5e65ab0cea9

Download Submit
C:\Users\Admin\Downloads\Nicht bestätigt 648407.crdownload

Filesize
3.8MB

MD5
48deabfacb5c8e88b81c7165ed4e3b0b

SHA1
de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

SHA256
ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

SHA512
d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

Download Submit