922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb

Analysis

max time kernel
1782s
max time network
1787s
platform
windows10-2004_x64
resource
win10v2004-20240412-de
resource tags

arch:x64arch:x86image:win10v2004-20240412-delocale:de-deos:windows10-2004-x64systemwindows
submitted
16/04/2024, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Acc_Generator_V3.rar
Size 10.4MB
Sample240416-yy81hsbe42
SHA256 922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb
MD5 627267770e3421378e82a76b53fd1b4e
SHA1 dbab8da0c78ac6ec4baa31ddd83b93dc4ea62259
SHA512 320250198c93b2074e090abe17ef0daa92ee281c3d910dce8de635fce7e96f8d8f369e50da9505398ef492072993b282d5e5e78da5a2c9abb107a5e65ab0cea9
SSDEEP 196608:VJpWC8XiWjTbI8IxI46xtNSxLhKaLuM6W+mPhX2xaEwM4hvmZQN0d5:VvErjTbBdtNaA0uM6qXXEF44GOd5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
6048	winrar-x64-700.exe
6140	winrar-x64-700.exe
5208	winrar-x64-700.exe
2864	winrar-x64-700.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 4ae0be7e078dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\de-DE = "de-DE.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420063398"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D2FF5355-FC2D-11EE-ADB7-6A78E137929F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{9BAB77A3-AF66-4C0D-B2B7-7DB2D17108A3}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31100986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31100986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31100986"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2883680221"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2811220806"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2811220806"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2177723727-746291240-1644359950-1000\{0395683C-D095-418F-9557-7C9E73C23874}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2177723727-746291240-1644359950-1000\{3B4C7212-F0A3-45AC-92AC-77035055445F}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000c9b34ce4cc8cda01ce5fbf87da8cda017063f10e3b90da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nicht bestätigt 648407.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
4256	msedge.exe
4256	msedge.exe
1500	identity_helper.exe
1500	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
5936	msedge.exe
5936	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
6088	msedge.exe
6088	msedge.exe
1348	msedge.exe
1348	msedge.exe
4156	identity_helper.exe
4156	identity_helper.exe
2216	msedge.exe
2216	msedge.exe
5296	msedge.exe
5296	msedge.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4496	OpenWith.exe
5296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of SetWindowsHookEx 52 IoCs

pid	Process
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
1076	iexplore.exe
1076	iexplore.exe
4300	IEXPLORE.EXE
4300	IEXPLORE.EXE
1076	iexplore.exe
1076	iexplore.exe
3556	IEXPLORE.EXE
3556	IEXPLORE.EXE
6048	winrar-x64-700.exe
6048	winrar-x64-700.exe
6140	winrar-x64-700.exe
6140	winrar-x64-700.exe
5208	winrar-x64-700.exe
5208	winrar-x64-700.exe
2864	winrar-x64-700.exe
2864	winrar-x64-700.exe
5296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1076	4496	OpenWith.exe	96
PID 4496 wrote to memory of 1076	4496	OpenWith.exe	96
PID 1076 wrote to memory of 4300	1076	iexplore.exe	98
PID 1076 wrote to memory of 4300	1076	iexplore.exe	98
PID 1076 wrote to memory of 4300	1076	iexplore.exe	98
PID 1076 wrote to memory of 2336	1076	iexplore.exe	100
PID 1076 wrote to memory of 2336	1076	iexplore.exe	100
PID 1076 wrote to memory of 3556	1076	iexplore.exe	101
PID 1076 wrote to memory of 3556	1076	iexplore.exe	101
PID 1076 wrote to memory of 3556	1076	iexplore.exe	101
PID 4256 wrote to memory of 2772	4256	msedge.exe	103
PID 4256 wrote to memory of 2772	4256	msedge.exe	103
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 4092	4256	msedge.exe	104
PID 4256 wrote to memory of 3016	4256	msedge.exe	105
PID 4256 wrote to memory of 3016	4256	msedge.exe	105
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106
PID 4256 wrote to memory of 4588	4256	msedge.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Acc_Generator_V3.rar
1⤵
- Modifies registry class
PID:5056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Acc_Generator_V3.rar
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4300
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\Acc_Generator_V3.rar
    3⤵
    - Modifies Internet Explorer settings
    PID:2336
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:17414 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffea74846f8,0x7ffea7484708,0x7ffea7484718
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=audio --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=video_capture --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=collections --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5936
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6048
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6140
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16343753767324876206,1381928553922176788,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4388
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\179559a460e34e519bc238a7b51418bf /t 6052 /p 6048
1⤵
PID:4028

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e4c7b1e879bf4bb588a1f1ea988b224a /t 3428 /p 6140
1⤵
PID:3668

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4693d23e60874a5fb1047a7a8c1d05b0 /t 1424 /p 5208
1⤵
PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea74846f8,0x7ffea7484708,0x7ffea7484718
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=audio --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=video_capture --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6456940360061575782,6035041172591750345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10
MD5 559ff144c30d6a7102ec298fb7c261c4
SHA1 badecb08f9a6c849ce5b30c348156b45ac9120b9
SHA512 3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b
MD5 e36b219dcae7d32ec82cec3245512f80
SHA1 6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466
SHA512 fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a090b2b1d0556956748241db5b485264bac67d41c996e75c7345379418f8c7ae
MD5 0a995780b8795d0c021f38e035dff7f4
SHA1 f954c6f8e05a2be26d3d5209fb14ed73bac3e0b1
SHA512 10fad96de7dc1c556eb52b147a439dc6eac63e46053c3114f16bb04a27a5492ce2cba8de4bef005f56b23de9e27103e3ba670547b97fe7295d814a58a6e7f212
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 bf97afc9ccc003e56505e7d24799b9a7f50f5716e3d8a034b96f32898d5f8631
MD5 7830d7f9861beac744f577604340adee
SHA1 17f1aa9de9346096c439a35e03e0115433d6dac6
SHA512 c9139121e3d633f853c9cc2adb252d006d43b48ca4e18f6b1cc4e1b6deae56e988eff0e303712dc94bb3885e13bc3f57fdec9871347dc3d27d6210f38f0071bf
SSDEEP 192:+xFZJ0iSVnLhzEPZ6YgKe+vjriup47guQ:+7wYNRrYguQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9f29f8d8f2b29e1e8ffa8063fb6cf9367f80c4101d9ab4a99d766db33cca864d
MD5 f5d9025865f6c6bc30cc641e66ff9954
SHA1 aef91e4b60c011d39f3611c75dd21501c363aaf2
SHA512 cf3185a32bc0ea06777f51b759a846f4e935dc75e984654fdd04226d4c6db97a9c1eb27ca67af729e21e87b5b07f0ad51e7c73f2bcc3afd8b3a6fd70f974ab2b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1c1f73189f180a72327444456b2d069061d6f0fcca345b8e8c6d928ce9793ec0
MD5 da62dc0292023382dd300a192095af30
SHA1 777837aac0fd71c4f7bb28a8e1fe27011620c5c4
SHA512 f098b6f3c151e8128115c62cddf9330f01807138ffe72549513db901d8f1d1579dc2090d6e71536c7e280643cae1da052b4bfd4f33ad39b53fa3325b4352addd
SSDEEP 96:8DxXRG0uIlK3TbqnHG4O7IhDlyzU2s+cB:SBG0LyCm41xKO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 28KB
SHA256 e5aa782a7eaa8b1edeb6e8ac8df2694341b205981271c3359bf83f9c6896621a
MD5 4fac925d5162e8f866f20bb10efa5259
SHA1 abe43d47c653511ad3aa4b8c1c9032ab4b1ac7ed
SHA512 7e0f0ea29f10cde1ba1c5a42d997f3f506d91c06d1cfd40b5a971beb985776b6c4d0e2478b71ad6546d8ae86790d54a9d0a652d530ee0c3d2c2f3c8e0c3b6f94
SSDEEP 96:y/NwCz2wsG3sWWtmXGwOs4qH0GlgDT7nRzrVr8A2sksgTc:y/uZDRNsOjXnHr8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 550ef67e9667aafc097f856245b12828cae83614d1a4f8439c021133bc6127ad
MD5 75cab9b48632465d12ce2bec746c3541
SHA1 7c07d3537a4ee9a2416110e28cfe63238f5e3148
SHA512 5a917e56009dea4a0f9d4b9f1a9a27d14c5d315101be8eb8b19eb196e44cd7a24b595483e9fe13f3a5d7569f7ba59523edc3d49567e1ee4ca1e15185c1b83ab6
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 b6fe0a279e75558c3b960c43ab4c5e5076b0f007319cf14a5c80b5307eff6413
MD5 66e76ccb794991420ce0f7fe7f2cceef
SHA1 bed03a3a4a78f17623157116c0284785825905c5
SHA512 fe12665ffa97aded2d5193ddfcac22b0bdc5d42d289cff553fdd08cc81ef88e70250a1be077dcd6fffce456627d5db7f67d4788bc3aac5ad1e49d3554d4b80fa
SSDEEP 96:9BCmDJ6M6fuJ6M5lkg05cO99O4sO/A8KPheDXTpUrf:rZJDQuJDL05Fv8KAXPhkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 2dd346ec215b683f2671115e9996974f8f5e4216dca058a01b48f4a1f673d036
MD5 2731c353b6d6d367c8a9e80b377e4071
SHA1 91c0e7fbb67b3f173e879931d717d34c527280c6
SHA512 4aae313e564c1c3e8fbce93c7bcfae7d945581f0ff4b7f1303286f39983ed4ad130c7dd579af503eb4c23bede96e5816b4a37384c3fb6e9a073a923b3aaf1983
SSDEEP 3:MsEllllkEthXllkl2zEgltZbt/:/M/xT02zjt/
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 7fb09b9aaecbb14ee3a8c943cf1ac8616fc1d2768a1a85e7e36bc4a857066392
MD5 465c135ff3f6bb6bf02d235165b69137
SHA1 bec3178fcc5f249d7d24f0a578eaaa672cb93b5c
SHA512 1e958acc9d1f4b15a0ae159729c7a91927b2f7c7cb7a07b057ab3d0f8cfaa4f16a7f5ecb006b829a0828edbced69be94449ffc7398b6ed1dc81c71f5b52e4b20
SSDEEP 192:XJDDJc2q6+bDo3irhnyTpvVj3XBBE3ubKJDN:XlstU3iVyTpJBBE3umr
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 3KB
SHA256 0d850ceb0a4473fe3cc0bdeacec0fbad3a83c3547d996263d200fd85552aac76
MD5 8ee06f32845e9d7ca1d0e9156093bb96
SHA1 f08518b14d64a436939d05d9b9543a67c260425b
SHA512 84ada40f32261136a9a25a31a0f6ea8855d7aecc79216a54d173ec24aa51300dae0ea88394b1719a1d620231ddff8f45cf408dfde4302e482562a76e0fdd199b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 131B
SHA256 311d24690a851156008b17c7b40412bf0d23588c6a68ea28fd3f775c07f21ebe
MD5 1d7e7bc6a8351fafae845fd050f48771
SHA1 bf2e9c6855abea368d06df73c6d8fac143b1fbf4
SHA512 ddb5c6b98c32a38d9488507c7d9eda85ae8d576067316bf9cc7d00bd1c127ede1665674e1cdb1abac9ac691f18878cba6d2322426dbdc8d362154e0932ce3af4
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 5fcdf0c244fc732e22ebc3cfd4a77ba908de8fd132d625776e1948c84a526b58
MD5 ec9fad6724983de3c95234c1e8aa63ac
SHA1 d5a4127194c1f5335fbd5be42c7b5fe7d5b016f3
SHA512 6812667e1fae1601375d5b1fdc86b467aed9e1bddaed08ce5044cd0c0bc05fa61b624865a715033bb8f12cca5e4ad2c6aed4da1d49c804bbc7e1890bf3cc3c75
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a6907e4c7e4a4bfc8f533fcf663d6be8cdddf1d275026071c6df2ee5a3635b1d
MD5 6fc78011754f4765ca485d12041a0e37
SHA1 0386d08fa7627586990fb5a7af26c960e19a6230
SHA512 c5ee3345d89791bfc6e01a1003fda391ec42996e59dee120197891cb37597f82b9918a697ed4d6d665d0348d7e8c58a917712e053d364004324b28a01ff6ef9c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 471B
SHA256 9cb892884c7432a9bbbf6482f20d2c588160640b675e5c8d1e916e1eb66621c5
MD5 953450f363b1a652016a73ad7bf00049
SHA1 ddd0ab7c9d5f7026e0081fdd86437906bea82785
SHA512 57a30ff872aa6ef6beca517b47b1dc71d7a8619282a8b8f12f866c99f6246c3780c83805353a2195c489036745a4b3873bcb5710092464081039e9b5af988c7a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 74c48f2af575d6ba7a686d6761c2df51342b65a7b8d98f122ec9bd58b43ac794
MD5 aa6a9e7d9ec908742cdb3fb9b8d8528f
SHA1 6589e0ad529e67bf54a57a9442a2bbef8f1e5b4b
SHA512 f06d7ca9a75f3ae785d3221da92b34b8717cf44fc4154591b8bc90fc83625a4f2d67d95ba900115c4993e9773ec85e6e347e42b2299e83e6b1587f5ddffec836
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 471B
SHA256 39e51e2d14140577978eef8f06a400fc8c468f4c643e5867249ff3ac21bd0715
MD5 5fd06b3761641d66eca9e6b7a26ab85d
SHA1 cdc1db36579e8d8d65f406db59fc3523ef2acbf2
SHA512 2fc110ed4307034496a58ca7b00d171452ef0aeaefccee35aa7f88b78c1fcd99db21078e87ee1d20484c2c38d1d9fc7c03f606d68e25325104e24fd7aa7f9ae5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b7837213eab1a3febd9413e54ce16336893316a345e9963de4c0dc016b41e9b0
MD5 c53de0b90319b07644793114daba20cd
SHA1 84fec3ca14cc86f26174d7ee96f8885016fa4ecb
SHA512 1c39115148f7f4f220645d6821faf3a07b9e8f080f59aac1ca4794f0e8fe1a3cebe32f2cde327f73d1236c2c5c0dc80b6202b6f026184ef61ca9cfbec3daa8ea
SSDEEP 96:nwkgND18m5DRwpvWMoiVmdeHvxecrUm0QyV+VDCzJEbb:nwkgVum5DRGWMXZJrTeO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 bb3a68353277fb75525669ca856997236214c35b6e41b27b74937b18a48b1b00
MD5 815b9212de0b0a49cd1f166a8cad5686
SHA1 53e7b9e4f0b4ddb8a587723c804bf6d9e19609b4
SHA512 d2d10736da7a7cc4d8673abcff2d4a89090585e4e752cab850020c522816616361f929dec0f7791263b727763861f1df8b221dc2a0cdb796e95700d9e38374a0
SSDEEP 192:nwkbd1gDRcjFWMNslYOIeErQ2BvaxTeeW:nw41BWjMrFaNW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 26ec81dde5f8d647f405f2c2573746368f178790f022d68d7ac1bb5e76ed7e19
MD5 b09228c7aa797ac91794c624d941cac8
SHA1 f68cb9a077d463810c45fbea9798a5d49401aaba
SHA512 1a6b6bb18dce887b557958e44f08c87d3f2171006304913f8589c6c2d05c799aac4f68abaa33e223af69c7cad300a81410a12ac282b25babdafcb05f99097f95
SSDEEP 192:nwkH1gDRcjFWMNslYO4d9yeErQ2BvHxTeeW:nwa1BWjuirFHNW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f3984b6df18814b325f1973dc6f339f844614e5850a04bbd2315869ad0690c1e
MD5 72360279f04d06490c0e1ff0fcabefbd
SHA1 6c7af76f91cd3ab2c79cfd430cbbf9278f619184
SHA512 1bdd73ffc17035870ffe1ddb096afea2997f418c4c2ee63c76c82821c9e34d84598c86a8e73c0c0942532a2197398d45bd322495a0d7a6d73a304e99940df96c
SSDEEP 96:nwkyCjD18+ODRwp5hpfWMoiVmdezu81jvxscrUm0QyVeJVD7AJEbb:nwkyC3u+ODROhpWMju8hZTrTeej
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 234c1118d5649f8f336dde1fe926b5447f31c6fa7fe2c5c5f2128c3e965074a1
MD5 afa7c968f1fc824e2485bf7fbb995421
SHA1 0fc9407cb3633060848136f018f17ed0e2645cc4
SHA512 e36edf25824b23bd4366d21b3e45304bd6201e27d4fadf87789e9ed84c6a40373415e072c6e26dc29f3c2bf721741794e06618d8c1b8ec8c0a9609e4d8c061f2
SSDEEP 96:nwk8sQsCjD18+ODRwp5hpfWMoiVmdezu81jvxscrUm0QyVeJVD7AJEbb:nwkdC3u+ODROhpWMju8hZTrTeej
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dcc2425f7257fb4e0b50254051141279a1ad34e05102582b0dbd6d94b343b099
MD5 95df94ae12994a9893afe8effc10cfe1
SHA1 edb408d3578645c780770e33abb3b5261a3f8429
SHA512 f10f169c16933e1dc098ebe5d8f24cd64fba898f0318f0139e364ff98383a8cdd993bb63beb4176591a6c9e20fa32cbe0568e4f5ce4af29b98c8c9657f818b97
SSDEEP 96:nwkyLD18+XDRwpPJWMoiVmdezu81jvxscrUm0QyV+VD7AJEbb:nwky/u+XDRUJWMju8hZTrTeG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 96414c0ebba4c18074b8dec28b8656af2dd8cb48f6828ed6db565bbb2a81698b
MD5 6db566611406d6fa0ef39c4bf3da29b1
SHA1 4cd7525a16134307769ac262325414dd5c04691e
SHA512 ed4a023d7c21c611732a1848c383436bfadc30595c0017237be793015e975c2a4afaeb2c8864cbfa95acee41dfde0be387f03eb326856ad7007289ed9beade72
SSDEEP 96:nwkmsQKjD13ODRwpvWMoiNRCR5mdezu81jvxuvxUm0QyVeJVD7zJEbb:nwkh31ODRGWMNsNu8hZYxTeeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ef5df25325e7c2afa9fb22dd97a47b1cb69ff7a371dc9ca9c0d43c313d865419
MD5 6af2350f929c3221b9a60d51ecfd8922
SHA1 eb11279173bfbc903f49b0ef2f80d364a51386ad
SHA512 88e87d8ba63698740e09f0b6dc2cbfda15862e2156576fa3d90e75121f9e363a0f45190062f9aee477fa785fb32823c826bed097ca0b86eddaf01f5ad8a35784
SSDEEP 96:nwk8sQKXFD13ODRwpMNWMoiNRCR5mdeTYrSMkdf5tx+vxUm0QyVeJVD7AJEbb:nwkbd1ODR/NWMNslYOBBvIxTeej
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a6a47ddb42a52388e959d14f84d6f3ce65efaa28ce64877659b67749bffd711e
MD5 3ea6a71c1981561a0b28ac37ad5ae964
SHA1 20e4ff4f8e6d80a0434372401a6435904dc1a1e1
SHA512 07a2c34e8c38fd05636fa2b00b8b4a2b5f896319cf6ca916506daf9c6eb74135f1225bdb1f64919f7b4684a71d4ee2ae0d94303e863975103ba0f9b0a499bd7b
SSDEEP 96:nwk8sQKjD18+ODRwpvWMoiNRCR5mdezu81jvxtvGym0QyVeJVD7AJEbb:nwkb3u+ODRGWMNsNu8hZFGteej
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 b1cac3a3ddaaf4dcde1bc1a0d970077786304d4d5dba84dbbf9681f712d586b8
MD5 29c5a01ceecc9ce00901d52c2d7402fd
SHA1 74a571bad58a15a7fc367ef9f812cdf472bb4168
SHA512 dea88e2b4f94651d74146c73338bd4a21846b41604e029371b716f910eabc039d1c29a813f95c9ecd36a929a3bd39883c5a38a1fdb64d099bd906517f07659d6
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 f29452ce7b92c1e22efe4434d2b94d30166ab8967eaad04b1de0f7b9528ce8b0
MD5 a5aeaba667376c121fab18ef9cfbd475
SHA1 ad9fa19d634f4ab53a2d4c442cd5e6d0c6cb1083
SHA512 c47e459ec2dbb7e0f941036284f323aca9f824ce8b6a0c6c43f70aba60b72ed68ca61f51c1d070a796565b710415e1f271e17562395e24ef886440824e02d68e
MD5 SHA1 SHA512

Submit Download

Tabs_13357772039420167

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13357772039420167
Size 14KB
SHA256 4f9d60d0bb928f43d497ac6ee3ee8c5ad83b43f2191eb9f60cb46f7d1cf67e07
MD5 c84db0db6103b8c0e7e1e53fe24a3bf2
SHA1 0fa8790c640ac31291e88065ec4253e55bb18c20
SHA512 ca5905aa01b7beefeab4839173cdf3474928a1422b51502d4cc83f4f9f970de0bdc7674f43502ab577da8c2da4397eab8332cb715bcfd2cf6dafb4ce628e01f0
SSDEEP 192:3lCMZyVLJYTf3nS18x55bXfJjWjDBR7GuE3ns3n2ddsJDWJoH:172LGS1Y5hXhaDGPU23sAq
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 187B
SHA256 aff86f9cad43c9af2a6f33195e87dccee85287179e15b12d94088b38e3de3fad
MD5 c1ebcb221bc20c9647020e07ffa122b4
SHA1 075dd1e1888f67c7fde9c11a55e14e25ed1795c4
SHA512 c4c56909a949ee3f76e45b5dcfebfecb15c035e53edcf6daa326a7956ee1b916fabfe2ab1ccbbc07e49035b34a476071ac698959b9f6184198432b65d08d0047
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 1c40c81e35a32e5da04110401ab5656da0eb5a500461d38112b31789d9c23976
MD5 c7babeaae5d1cf124ac3d6a186d37368
SHA1 64ca56ec4ccf61642383889296a155e18bd34a44
SHA512 438b6900bc0cfee39cb91df8434e02ae7872249bb89a1cd491c63821074deeea86874802a54ecda38c60bd8dff51551e784e880f2c57c5380a5e4e401a68c795
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 a265bb6a80743f2edd577542c72b48e9e94144ebeb36b18926d25676813907b9
MD5 f44f3bb1a6b3c5a0d062854d38c59a73
SHA1 8550790e8a079cd22b4b38c64d96b92bdad8e3e9
SHA512 c3f3bab38c35eaccdbb1973d7f2a7be89a8bb650c96cf5513c40c12f9ac0df37d4c0981097126876c0bd9e90f3d577580c57dc7894e8c3284bd80f76890d746c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 8d41848819b4bb259f92b6fa3cb93bf666e3791332dab2b1ab4c3fe2445ebc52
MD5 8ef49718e1ae9f01c4010d9fb2fa8968
SHA1 151223f8c96c1af7d5c6b0eb9a223260ac7bb09f
SHA512 2b4008ef5da8ee7c2d32df69e7f5df7dcc7307bce5f50fa7e78d3e389baa09286f83d0ff88ae7c51ed22f1ee5dba59329ee1d2ee9dff96cd6037982d19d909cd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 7ddc23d9ba7279586ca187220a5e35ff0659df4afeb4dbb7b83b35567e5e0943
MD5 215b974d8919db231c370288d744196a
SHA1 8c374e6c868a6ebb37bda601a3913e02d7b07df2
SHA512 3ad6f62b9361c43abcb953bc44b821d0945c344d2e022a559656ad9935f4c8fde128cf989bbc7eb9295163f7e99a38c5654a16ec9c67c14c39c9fac535a24e9e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d4ce5b768fca484c88164cb8dc2f04cc9cdaac0b539ee05285bff4aa567c6cd5
MD5 1595fbb59f68f92218b4693075fa5617
SHA1 d2892cacf9d025e9d72636286842f11275a4a423
SHA512 a5dca1be77a51f047d0e383ab4669ad8c05aedb17cc00b04d21efa83a1c6787a83714a1d13d008204ae2698a08565187f48cc08e1e670da9e98f92083fe0c266
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 620c4bb4e69f608018622903ec3661cdb147eca0014f1c4def1b9287e76b728f
MD5 5299242727e66dd393d7fd1aa28f0f76
SHA1 41b88e7617f3932677605c80999538b313437c34
SHA512 99800ec63024760fa0d50822264e080d4db47e822d45c3076581c3d12bc798d058caf3b55ab6466d5d25450210b3bf05336466031e11dd1c015c4fc6701faa80
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 66eb66a0eca428fe404f9a332526590019bcf7cbc3916dd828dd4682d00d1927
MD5 4d33af53a9059c0d153d91efadc38d22
SHA1 c1a627337577c5b41c8fc0e56f01261bfaf9c1a7
SHA512 3c4226d00e1d5870c269b85ad718d49f1ab3660826faccc4d71af87283d6986453e1fa8e638611c2e6729140b9b7faa0994ec943d4b9bdd7ab29f7b18721ad1c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3063cb8d07eb02c0614bfff5e28594a4cde8285f74e55808d28ca4907ccb9737
MD5 70b4a4c4de7f7b42487d28321c96e4ff
SHA1 38545a4def61062f9202a220968d62ff22e7df3f
SHA512 afd7acf7a238ce5bfc2ebe742a51f5a91148ed337bc1d4b6977619c9be963a71882919c1703b2d34270057da3e7645831076b8be1bc6947d85f9c305eedc4ca1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe586e84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e84.TMP
Size 705B
SHA256 ae499849014598f72143aabc542679e7c818b2e66ae658e32f0335662afab663
MD5 e244df995a94f864ccf6c98d9aab8c66
SHA1 4df8a89438ba750fc2bb2043fab8051ea7d54eb4
SHA512 47f7993087e96871e3441c320285f14f4bb0bb6bb7c530bc3cef866a254865f39845f3af8d8265bf99c323d474263e944425fd2518580dd997f55ef6fa6c65a1
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 f57c10b9841c2a6c5c774b222888686a188d05e55ed2c733942f99e7994d860d
MD5 0f019932339e72b60d1ba685eed87ca7
SHA1 9ee093c9607aa476a8f950583e2bc2819fc57bdc
SHA512 45a45f7e6eb9b92380101dc858a5e39c9847bc2a95b95335b6cc6d29442c69d490617dca4654ab01d244933650442b249b4a6fb404860e75f45768cb84d9ca4f
SSDEEP 3:ImtV+izHl/tR9L/U4fMlfhymNRl/I+l1:IiV+ihn9Ls4+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 116KB
SHA256 abc47722e90610f5d8c634859e1a471eef78b3c095279883711819e8edde8b25
MD5 e43c5f79885b94316194751e0c41e815
SHA1 5d92eca3e00251e2185a621d33dece476372b0d4
SHA512 ce2dfb7a9d8ab23a6c211abfa3128988348404bf1766d676f81df5641950958423f352c76c2f603710bdce703601ec35e9eecd5d12545ba56b7ca04e774639ad
SSDEEP 192:yTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWamGVumQ6W:kPWJ6a9xpnQLqtzKWJnCVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 7e9e3f24e0df5f11ff4ce2a782c822ec5184d1f5a0b8543167b7abb64e941058
MD5 1dc9bb06c315fabec14fbb37f14338dd
SHA1 ed41afab51c877805809b7ea60937429d70fde53
SHA512 be87d0910be182712c11105b98f6b132f428edf0b6f6e3848191dbfb4624d728bf391834f037dd7850e0be19b4ca573f1592c0b7192a6a6f1f08b74b404d8a99
SSDEEP 48:TtUYVAKAFXX+cq4PslA15DTw+shL0/pOSn6QAYNQ0/h2SROzcy+sevU1Vj4qLp7b:4NsMbfjsho/F6dYB/HsevU1Dp7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 91KB
SHA256 34d8a314031a24cfc736f8fd7079531d29028ccbb2c9bcc64565baf10e240d12
MD5 8f058ef1c0d3b58b42c59d71478b0aa1
SHA1 c3d79a7be25ac878a16055a3708c1db5c4e2e210
SHA512 edef3ed1deb3003605f4b1bb5735a3eb5b14ba38107c36a06d3084f1009870ba5621fae3566231d0fc1eb9d8255bb954b06aa89ff66d445336844eed9d1106f8
SSDEEP 192:2IN18hvFThETmHfUmL+7pdjwvWPvJ4ry7pEZ8G+dfyAk6OVzEqhXW3mbEt4cy5he:8sbRMO
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 7009d8e5eb7e10abfd46d418eebb9a9030e09a37c667fcd755d1cfaff89a1fdf
MD5 98f8033ee48e9147d719f0e1a917f220
SHA1 b3714f7556acdfdc71827334fe90b2c42625d312
SHA512 9af9870637b17f1d29a1e07d0cb55f3f0ab1d74ef40d33348fc9db67bdcfaea74726ad9746a0de1da22e45b0ec4c96bb1eacbce4741758e9f95fa31b9ab1d58b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 594B
SHA256 3ddf0e7d2712862b85a23e0bcda3b8fb8d8e3a177c63ac81f46d068e19c1ecd4
MD5 79f13216f5be81b0e609dc95f9661ab3
SHA1 ccf40bcc2a732f85964c781fb440d66f2e0318fe
SHA512 526a2d0abaa5974177b04d68458af07100b134a6546cd42769a39d78d1d9423b4a7c4848334856844f7d825334c917ebde32d7b0b7b1df5bcc79b83e171a235b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 659adee81eb0f83c23fd3b129d80caaa4a8b0cb7140bcd385d5f7e4a0d4eba85
MD5 8e39569840f33b357d9003c58b1e159b
SHA1 d6748c1380f601e16d94befe7dd15266fd71617f
SHA512 3d5b6f5deb9748b08e59d79e4fc3768e40fc5cc1b33c1ec3d81aff98a15eae9024ec1e894cc4fbd9c30ba5643d1f39a6111982fd4afb4a138c1006e5acc64113
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c317df6391c6c349ca0a067b2e8bf4399e4785576f75a5be77030d1971fc9797
MD5 0c543981222f331e56e2b7b731e44c1c
SHA1 3eca7408cf65cbaf8942d557bbdd792a39333c24
SHA512 fa9c475b1369a1e153554e271189e64be8b2bbd1b3a66cde454408f6b6e3f525ac12d75b4ab8438cf397e115d3e4eb2190bab27e8892f3c627ce5ab892fc9a98
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi5+7vfI/b5qZP2RUQfzzdX:A9iIxuERzA83h09RZxY4JhJAKO4U6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4aeb0202a5ccb615f4b49f59767a7fa1c15faf3bd05898f9423a3d50dbdd389d
MD5 a2025e97432955ba8f00ceb9b7544575
SHA1 d9e07a425f9b74135e9ed31ac42cc1d53383313f
SHA512 468767ac1bc194345c1fe4e65ee824bbe97a599e64341a236fcd672e1f3244ea419a74f8522f31a2705911433214b9d9974d47214d7bda50971d44dbd9ff3a13
SSDEEP 192:DoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi5+7vfI/b5qkP2RU0SE5il:j9iIxuERzA83h09RZxY4sxWpnAKO4U6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 75ba341c6993a2357d3cf7f0354463f0559e8d549a556a1755a92dd36b3b3ac5
MD5 7c0ff796bedcd725798e1d6e26c809e3
SHA1 82d2228fddcd41a8bfd01e09702c7e343a5c3938
SHA512 f4a3a64c178b87c6df8e253d66bc8b204891dc0b3e33c6c19efe0e9ad276354fe8b6a7315c2fc75a68384af6e0022cc0dc5a0ef17163ee8bd6f302effc864b7d
SSDEEP 192:loCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi5+7vfI/b5qkP2RUaSE5iO:p9iIxuERzA83h09RZxY4sZWpKAKO4U6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9452db79c1072f00681b067a8f6e965945b46aed675aeab061d48ea0683e9656
MD5 320e34bf5705daf6b62e563fb5307431
SHA1 9c7e87ff981be5d3a0eb38fdbe8bceab5e80445d
SHA512 bc2a542800878e99d72f92664ca25aea0b7116b0a82e8f98f8e6b5e899a8b21d193eba5371607340177098d6ae6d70f30ce01a75e7bebc7ab4c868ce9078570c
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi5+7vfI/b5qkP2RUaSE5it:e9iIxuERzA83h09RZxY4sZWpPAKO4U6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ab264884940ff6261397b78aace0585b2f017b1abe549c5ffe0646d2f565a59d
MD5 f85c2954552164d566da3d1e1e10525d
SHA1 3ebea86f57879c51ca8d9958b6325201b6178cfc
SHA512 4b773545b1c86cda6ba794c1fde969e6f1338d0a8818db12d77bc9a27e6d854f28e414cb55b8fd71c0ef2e0e0884aa4a442dc25b4391f36fd425b4d5c3905abb
SSDEEP 192:voCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi5+7vfI/b5qkP2RUaSE5it:X9iIxuERzA83h09RZxY4sZWpPAKO4U6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 716f9847778ca18f1a099a93430f61dfca74cfeeead7f933f40f6025e814d987
MD5 5ae93df0ab102f28ec5128adde2889bb
SHA1 a7dbaf27482b0fc41f4e906f2eaabbc5dbe191b8
SHA512 8903ac2243c1b412d7030e760a1c27e4ed0bcb216bd2c8621a4b76bd25590d72a9bd11213ef68857b0cdc30103de8b6e8d912061c6b0f011dfc50e1bf98146db
SSDEEP 3:MsEllllkEthXllkl2zEgltbl/:/M/xT02zjdl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

de-DE.1

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\de-DE.1
Size 18KB
SHA256 afd57b0b6d8166e25bbef7cbc97522677c11c9a930fd4d4a204d1b7ae6258492
MD5 cc5361b5fdccfc6830217e2eb9972dd8
SHA1 e4a1206d9190eccea3e6a116c954d11da0aeba66
SHA512 ef63961bd7f0d3357d352a8f9c8ea57d0271e0fb664b1be179c38cd2d559bbaa4864f64f3521f26f868cc074f97994e2658c6d652021a39dc5207d45411691bc
SSDEEP 384:hyeOgI05064FlezTyIGhWVI/ExAaiDwjyFGW3shVQpXPLAozBaMdlHueilgI:hyeT30tczTyj0YI1isGMhVMPLAoPHue2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 7KB
SHA256 239dc9ecc3db30f3418237acaf04843162c261eaed07323a586f48d0d8be4182
MD5 7d04612795081c4f957f395cfb3f3262
SHA1 3f2992c224e965e926a415eedbdc78cce03cb441
SHA512 71f61f25e147e9201efc24e8833f2ed1bdc67e4734262c4ec1530b59a0783f13df13ce2800d29c6c6d50c1f916db2d748c16c85a53dec0a6d6800956fe8e9825
SSDEEP 192:AC53ufQlJyRw1daue6NJCHdexROGGTW6fOiRIeXt+:l3sQlJv1dI6NJC9exXF61RjXt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acc_Generator_V3.rar

Path C:\Users\Admin\Downloads\Acc_Generator_V3.rar
Size 10.4MB
SHA256 922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb
MD5 627267770e3421378e82a76b53fd1b4e
SHA1 dbab8da0c78ac6ec4baa31ddd83b93dc4ea62259
SHA512 320250198c93b2074e090abe17ef0daa92ee281c3d910dce8de635fce7e96f8d8f369e50da9505398ef492072993b282d5e5e78da5a2c9abb107a5e65ab0cea9
SSDEEP 196608:VJpWC8XiWjTbI8IxI46xtNSxLhKaLuM6W+mPhX2xaEwM4hvmZQN0d5:VvErjTbBdtNaA0uM6qXXEF44GOd5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nicht bestätigt 648407.crdownload

Path C:\Users\Admin\Downloads\Nicht bestätigt 648407.crdownload
Size 3.8MB
SHA256 ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24
MD5 48deabfacb5c8e88b81c7165ed4e3b0b
SHA1 de3dab0e9258f9ff3c93ab6738818c6ec399e6a4
SHA512 d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af
SSDEEP 98304:sWaWOBfKnlSXdgRgopW/r+N5op154iXEBdbwUoy60518ymXM2mGm:xamnqdgyoE+noL54u2wUoylrVmlw
MD5 SHA1 SHA512 SSDEEP

Submit Download