hxxps://mega[.]nz/folder/mAIQgYKQ#wW4zoZTFghebYGUC-TNZkQ

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/mAIQgYKQ#wW4zoZTFghebYGUC-TNZkQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{9CCD21FF-C585-4940-89AB-1A7AB34C5315}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
4364	msedge.exe
4364	msedge.exe
4472	identity_helper.exe
4472	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5144	msedge.exe
5144	msedge.exe
3088	msedge.exe
3088	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 54 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4792	4364	msedge.exe	83
PID 4364 wrote to memory of 4792	4364	msedge.exe	83
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 3932	4364	msedge.exe	84
PID 4364 wrote to memory of 2068	4364	msedge.exe	85
PID 4364 wrote to memory of 2068	4364	msedge.exe	85
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86
PID 4364 wrote to memory of 4664	4364	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/mAIQgYKQ#wW4zoZTFghebYGUC-TNZkQ
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff9572946f8,0x7ff957294708,0x7ff957294718
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8344 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8212 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8592 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8692 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8700 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8244 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8248 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8464 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8704 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8572 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1430888353878524466,8057400066681801774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x2fc
1⤵
PID:3196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5808

C:\Users\Admin\Downloads\Beasty Cracked\Beasty Cracked\beasty spoofer.exe
"C:\Users\Admin\Downloads\Beasty Cracked\Beasty Cracked\beasty spoofer.exe"
1⤵
PID:5144

C:\Users\Admin\Downloads\Beasty Cracked\Beasty Cracked\beasty spoofer.exe
"C:\Users\Admin\Downloads\Beasty Cracked\Beasty Cracked\beasty spoofer.exe"
1⤵
PID:5432

C:\Users\Admin\Downloads\Beasty Cracked\Beasty Cracked\beasty spoofer.exe
"C:\Users\Admin\Downloads\Beasty Cracked\Beasty Cracked\beasty spoofer.exe"
1⤵
PID:5472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
40KB

MD5
3c2ac6ed09323fe172784cdec7f3d671

SHA1
79eb656ac99f1a2efa7fbf8e8923f84dd2b63355

SHA256
67d42a456baa3edbec1eb21c94f294c04a72bac350acfae80f4f2b65afe8bc5f

SHA512
ac95a571afa882744a42447e84c1ca5231303ba33700f63e99d58860e9635ddc861745678d5c74b137af3d50daf05ea710abe65b11ffba95e2b2f6aaafb65071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
1.2MB

MD5
047dbaf7429bd6fb2e31adc052b78641

SHA1
e6a965deb29062afffdd1778d12d49c51bd92910

SHA256
9057108a2b9a91d3b01e29aef1222826876f3922c704a3759ffa474b0b876132

SHA512
a4d0971c9ca2740336c02ef9e703010585ddbd977197d97f85a6e0f43d67ecb7af71db6e5b83a34c05c1e076124ff63da2cc3634108389fc55cab7026fdaacc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
122KB

MD5
a8baea40ac6ad8cc7ab6930256c95420

SHA1
1e4221c6c7219c4bee3da8dc2dfc529ea276ef80

SHA256
89e208cdc8e2af3dadcc1a62d115d25ce3db66e3292ac71b5a006ea025aac1b9

SHA512
1ea9a4aa54ec95d5a7259b36f681492d05f34df3c4a2bfe43cf6c632c34d13c27c5f628aa6f6963ff8684052ba78da4f58799d00383273527521b91688548b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
62KB

MD5
d42e0db378c3b7ae639f482be65ca7e0

SHA1
febb6ba0cb20fbf345e42afbb194f557de4fdb3b

SHA256
9a978650fc7920f6ce184b5febda53dfadb49086ee56326e0f7ca999b7e802ef

SHA512
2031173e0dbdec727a93739a44a54496c3eb068871afffe4cebd2f57e8e9c45ad016c3fcc0030fb871b86fd5619b1285a16ac7dd593c305e886d55d4d4575a6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
29KB

MD5
4ae540714475aa934955496d990ab15f

SHA1
b7724c4d72a422b86f5dc06571ff4bc86f0308a3

SHA256
ca0222f8799d862ca8c427d6c612878f47043c9445ad0e1567f1f80e83c965e2

SHA512
1f2b02e49a469b6aef11aec3bf2409d672d8e5f07572d98767389cf13fa8af9b04ab6f77151cfbe01b0c5383cc2bf9728907b73723a526f635e24b58109c4222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053

Filesize
34KB

MD5
c2652906ed441a79b3ebcacb1554ea08

SHA1
d4ade0f6b352c21d1ec06b1178d723c2e943baa5

SHA256
f0df10713fd6212b0b544b8fc6561cedf12b37f19139718c6dfa1448cd385525

SHA512
63526c4e80fba809fe7a63be4b82e53088e92dc930168be01b8a43b26a511f56f97b27c1f14ea0a82c15302e19b0a921cbb604aa81e902190f2461a25187256d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
168KB

MD5
65316c255aa0bb51d017c44d41d23019

SHA1
4c2d229da9e5fe95157db658d673d2c6085a8a5a

SHA256
2de41e7ec25fabc6fd9e1376094b9d55dc024da1d848bcbee901e394d192b4fd

SHA512
03f1fb5049efdd64edeac1e4c6d6f4fb51252e8d401aa09c640cc560958660686c4a3f590b98ccbe3ffc424de88d7ffe823deca79f2ce904684a1367c8e55671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000057

Filesize
29KB

MD5
d5d9ab1a9bd6c309a3358c4241b81ee5

SHA1
2674a0040bc17a13165b664fb8a9c77949052bf0

SHA256
05b7a01ead6e437b4380b3efe5cdaf1b89a1ad998476fa6e7f01806578c83ea7

SHA512
d25e0a10d35b2ee79ab623460241e3e30b6ea6849f34c7c05e881fb16028f2a142a62cb211f7a5da4c6e75b3e88bcb2695766262d178df282db5aa08520eab5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
16KB

MD5
838b97534fade84cda11153a70c55b4f

SHA1
8f9f0a0c8c91e67e13c9c067faae53b58d1e9eec

SHA256
39cb80fb714faee8596a32cf9d0737cd0da7b9140013fa848d62ecf89fb3dddc

SHA512
c65686b3712c812601c314a6eab456678dbec4b63f7d1fad3c7c329f7bf6c5f381ef2125dcc040b82e534aed521e3f584186b639a73562cee4c669b0cff4398f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
151KB

MD5
95e15ed575952aac83558c460243b630

SHA1
eb9bd9a1226a21249843595784fbaafbe97601b4

SHA256
816e156a34a5fbd887d917f70d85b7d838d5b98825d70908aa00cede73691c4e

SHA512
2f11be0eb5858ad0362841cc91e7d2d31f4193a746992990415b570a22c7719f57214e89adf277c829ed64bf6a6cefbcfc56130635270c5c57c584e261d564fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a

Filesize
89KB

MD5
554d4590a08f0d859ec734572a79625e

SHA1
a9d2f9f0bd2a7ae78b1cc9772c06eedd5711e8dc

SHA256
ad50f68e6b4b7190b0f4797788c878f11e5c8f63f6f2c55c2a407e7c2ddbd786

SHA512
83942427dc1997b6c3f488834d701885bc03771d049b9981d9bbb898c423af6bd27756856094407505c9e89d7de2033551d8c9ff20f82defaa58046cb50a2ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
94KB

MD5
4e60503f8dc17427e4eb333d5e4decd3

SHA1
bdfe7ca7fbd0561da747a846bdb2f6d15a481960

SHA256
5a98903f930b1dc0a6729b1e303ef95679095a9f14500edd318b3cafdd611b4e

SHA512
eaaedfe17467ca693b518097a2a1db8117d4c239ccd1600b90f2ef45c69686cba07c5f1f5602ef1337fd2c1e511cfc102271344177b7fb99917404ed6453aa91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

Filesize
141KB

MD5
3c78f42e52d6de58e73ae21e2cf1ce56

SHA1
95d45f11832ea39057972909c42175448ef5c1d0

SHA256
04ba5103e3c56c29fe2b756510c0404446d3ff404924b177017b2d9ce264f455

SHA512
6e47c3af7dee53c7c1a4f06582a41cde9782a25ab6928138f16babad7570483c8c47ae3e2ccd51bd0e9e42264eb4e42a5983e3dee3f92a2908b73bad8ea3a369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
140KB

MD5
92c4ba4113cdec1cdb973a046fdd4d54

SHA1
a6d11719141a16577b0fcfe079b8031b33fb5357

SHA256
841b093cded7103e98a783fc3bfa594155c3241472613ca4991c5785dca73fba

SHA512
e10a67ac7d662d8d16cde0311fa0f221efab54dc2d4e1acd1954ccc79bde5e3b6dc4fe3a99e23735ea666c3b783d5d0c5c758e0eb71f0cc34c1251d371318dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000069

Filesize
136KB

MD5
810fae5f789e59a67eb7d17eb4827b16

SHA1
ef8f11ce5d87e47e25ba7203ce435dc41a19e010

SHA256
feaf05f1a488ba4c478dbde800718fe345da07f7e1d28076ec953eb8172c14e5

SHA512
280d402aac03ed30b9f42fa1f281eb8d567a78c52653e37141240aacfdca610387ff6ac8b237efa4a4c02b6aebb81345b79fc488a658ca4ef525bd379e65806d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b

Filesize
62KB

MD5
d595aeedb6ab5955252895140cd33b2d

SHA1
54ec38264ca7194d6df71d5a5fe4b7dd5b4b5130

SHA256
94449a2e74b33178a00cbd79505d9251a0fcdff8ee1a0ac24352a6779ca34fb6

SHA512
439d8d57c0e938f28804e4500f6549569090b7e52c9d4048ac8ac266e7732669eeb017b7a32ba027abd590ebd39658a443baefe3a125f28fc5ad00176efa7bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

Filesize
31KB

MD5
36c9caa1478083bd6ecf7c07649ff6c3

SHA1
a44d0b10ae53f6ea46bc450acb5798c159a1e412

SHA256
c5aae61399b871202548f1f2df7af726b6ca8b8026600c6ce1cf9893ad0d80ca

SHA512
2e15e8cb6776985ad7d30f9ed750052334027e4e38adf80ee6f46f3cf9f9b2b79a9df1913b8f854ce81f39c9228313c2b7faf597cf19fef5ef0b127ae3b2b1c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006e

Filesize
250KB

MD5
cfba6ecf9db4655112cc400a9dada870

SHA1
b0e414bec21599505988b601c24427ba7b271d43

SHA256
090ef5053db9952f8a42eda3cdaea90a5e80966a41dbc2e6f39d95176b6f6f74

SHA512
63b7dbfbf409e67cd11d5c5cc2570d7006eafbb28b0cdba0ba4c432984ad3183575dbe2bb88c6708d537ae2e27f4e957600601d40debd95a8ea911198ba59772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006f

Filesize
16KB

MD5
49295de6ccd23cf80b6418a2d209868f

SHA1
42a955b4560bb22cb9b5b39577f7a691ea345018

SHA256
d5a29c73c6200af2ed6918a61106e649b92098ecd476830d725ed4d2ea5a8efa

SHA512
2954ab185fd84a08933bb6e79d91e301021fce4e632b477e765c172cacf72913561e101ed2f7e66bfbdc5946b35f2b63eb2b6f878e0afc9d26ffe71ee112a1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000072

Filesize
19KB

MD5
2b845c3bbfbcb4e28ffbd1838368decd

SHA1
4414c101a651bbc06ab2d1eced6932338278e7fb

SHA256
addd85cdf92ff6c8fe37ab271bbaf49b204ebb8f0e0782ff412959c1e9ac57e4

SHA512
c6a374402b6b038387d385b81040d0d6ae83b2a503be91335b4b641e9eaecace2696871b7ac79af7e78e526212de77f128738cd47142c8ff1494a11bc3a4548d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b

Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d

Filesize
64KB

MD5
d84862513956cbe61aeb4ebbfdd3355a

SHA1
14ab269df17cb0333b1556ce120d587324479f6b

SHA256
a18b26912ab9e034923cc64fbfdb59d682500f2c556456930e480b6bd69e33b5

SHA512
d04ca96d72595f1e291a6ce96f092c1707064800103cde733512a186c1b22e089b63690a0c53965c97248dd782731b22fa2d27b8ee3ae112647382f1c06d1a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007e

Filesize
50KB

MD5
69a7aa3c107efcb775cbb6960107f65e

SHA1
217d820731f85ba4013b4a6f4236539a5bdc2726

SHA256
df917d4fa2a2c699a37d5ff323c970be0dffab7f86f50937053a7147ed864297

SHA512
74cf70bd1c8900927f4ea8aeb2d3a87d3368daff2f8e43855a655600738621bd1d3dc8c489236e5ea275ef11244d1d6eef97165d05f126d1e0ffbf9f4b8143bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000084

Filesize
1024KB

MD5
99061db4beb29630a3e16b22e0388d53

SHA1
2fd6132716a4bd805a1d001c0e5c4ad165b152a1

SHA256
218ff417f830c79ec7a8a4dc9bae7cc728f6e6b7602b06f289a2d5bb24d8466b

SHA512
fe5a69e1d95d76f0ab99496bb86152ffd48e271c72ea6fe2c7858d85a5f5df9968dc8c1374386146895fba8e88928c96f555eca9edac7a16881a9b5b7318a369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0c480c18bb43f33d_0

Filesize
38KB

MD5
cbbc7e93998c477836c0348b44fb834c

SHA1
1d505222d237771d76c5204e545c957faf7cb4a3

SHA256
cb2fdf1aeb270249a745737f2fcecc53b32006ac460cd28733ef88c1f5e1be63

SHA512
8ca4870d8261483cb3d1f1b5547f1ba43d373fa8ead1d77251eb19b5a6652cbef3adbfb8f2fa59b4dc068ed36f96676a0b393987ab0be70690afcbd9dcf0df03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a33ae09a3615370_0

Filesize
278B

MD5
47911737c6c979b06d70a26a522e1d78

SHA1
8624d0ed4fd22dc3c2141929b465a70b148f4331

SHA256
884940b80cecd82471ea2aa90a75bedb96dbd79404a4a65e76d7ab56ec957cef

SHA512
8f68b4dca503ede9ba949351e6541c007d638f403adc39f494b10b3919d0c36db579086db3d532aeb39058ee21aaba5eecd921168b24ea8e99e4f66cab32f9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84df3ebe2c986b27_0

Filesize
54KB

MD5
23fd4fa5b48d76b84b48de11b5784357

SHA1
51e628cb66c9d592dade03448474a8cc854fea6c

SHA256
468d28c711d98a433df12f44535b42cefcc47d5d3df3b79eea24a8f1292b7421

SHA512
d4791e27d9a7c60b4e00d96fb8d0deb79d167de12af90145cf53656de4f2b7c1067f37f81a4c09575a4cac80507392eec1c295b5e9285dcd2bb0a4ff31cf767f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8895ef8cbcf693fa_0

Filesize
53KB

MD5
846ec6f39466bdb6fcc2e421a7ca53b6

SHA1
d86b501859929e0d205dd5883566d1fe79f1de7a

SHA256
d34a14811670ac123e74e097b9894bb2d417c90edaae875e793fad91abbaed7f

SHA512
beaf92b5dedcb2f1220fb53c85f5913672cc710133574e69d14dcebe63e604afbf2eb4aeb4d21ac17880b3cdeae1b30c5c454ee2ad598e8753a89a042ca66b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d8cece29b3a3471_0

Filesize
338KB

MD5
2aa053de1f246e68ae82133d04e65aad

SHA1
b4aba7cc326ae86affbae35c61c704de45f40a87

SHA256
bd15aff676f88aebe4ce3af73ae2244748a04cdb74667597fa90912489f8173c

SHA512
4ad8e121621b7318af19e6738bcd9c04e26894a9acbdbf1703cc82c08e06c45aa4904eab0bc7a7920f48b42d70a3785694d0de82912449810d4aa11408cfab06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa456d9b7547bc4e_0

Filesize
268B

MD5
4e9ce8e81cca53fe475f854e96e25242

SHA1
5f99eeaf4122999f932d9144b80b65eb4f854c58

SHA256
732f074bffadeb4f11b41e581f07f8b9434e556e7fc634b086accca54928b2b9

SHA512
2e83d9bae0874be454ec97a56a63b9af26de0731384c723ae4e559618a265102c0c87bbca6633c531b1570340392a30461c1569488ea0ce175315d15a4904271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ac47f3e3d77611e9_0

Filesize
14KB

MD5
cf27c6ee0e6c5372530eac1a4639cfdc

SHA1
7cef42affd79427e01547d604c044e51bc455033

SHA256
e0f84c92cbd8154623625abac10c2a1d304cc125f3500b7aecaa513cbfc7cbde

SHA512
5aa4218c2570e0a4fbfd27c46016e6184d0907242bbd9ecf3d34d2b1c06f0d1a90b87bac7d1701d976b9212623d08b955a64272be3b3ef646a8e4523091e6ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c06ea8db370084dc_0

Filesize
23KB

MD5
ffc2c005060ab86c5c160b3cd91ccf66

SHA1
0ebf74565e13a759b2826408bf96e488eae4b706

SHA256
43f18b511bf075b552c72547c65bb1c4b0fbe7e1d6d8f48cbb8fd44fe578452e

SHA512
254facd4645b32cfb952f1e1ddfb47a1faa9c78f70245c7fe72ab25135cebfa258908025e6b4127cff937c0da8b74d9dc1dab71f38e440ff3cd381739fce41c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e6b71dc480b197af_0

Filesize
157KB

MD5
4eee3797284d3f15e36f0f7bb1d0b075

SHA1
2cb3fcef6c18641f76301392bce527ed395dd6f1

SHA256
0442990e0261a8c629ea6d8892112e25e7db10da9f176a6ae8e6113cd215c2a0

SHA512
8e02960ca3c25c9d16fb883ac5bee18cd27b8877206a1c523972beeac63eb9a1913c97271345d4757e2e6c8d4ebb578fd6883c5fd7f9902dfad7a29827680c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9cdadd8671535dfe96e3b61e87875dd7

SHA1
9a329bb1a8ef393905ba682b68069512edaba941

SHA256
ea4df4086e43ec46df5600d66cdcd6d3156df71cd8baf359992d2d61f7725143

SHA512
9346fc067e151c347e53307315f186cc15422b0eb461e3262c55cd2e4a7807e52d939c458ebcf42064713f744b02147afcfea5c9faea55880f2b6a16a6ce5fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
258B

MD5
2af45267beec0d905b81baba591e58e5

SHA1
d7ebfa1fb16ecc563901f0fae767b6ef7f0976fa

SHA256
7e8a74a7009899f8042b98847e1c8d967987bd2f323267b881dc8b0c0fd559ff

SHA512
614f0f2e87ee3a9b05c22d6c420daf601e9a908a7724f4325df401cc01021d1106c71867c0fc5ebe9829c48c046e681ff446e7bb94aa4b04d246cdec1ede4c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
c7c9760bd8cf30244dc134dbd2d6e739

SHA1
bb7f62387de725fe4749f2d36781e498466f34d8

SHA256
084c9324bf403978d71e29a3cd357322860dfa1c70687f28358161b3f22e6d38

SHA512
cdd3cce4fd8ed280519f86f40ea13454449693ca905ecbc7654049040baea281145763e8354054a9e72cb4a0efcb11e96f2ddfb30e223d1720a2485928eeeb4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d1d228daa71ee36128eb892854d4fd5

SHA1
06564f40ad752ad73eee3217cecab3a446d84bf6

SHA256
b9cd9daea77a55189952c105f4013d31d0700e125b33eaf8211d00bc9b22c1d3

SHA512
cdb09b2c6131fc82621ac4f932588ba29a282a77b9b383019ba8184cbd95a310b02ed644df42bb3a27d4deef4a34fc2e3e8e6dd41406fc42d9e7f67e058433a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fc5bacf96b09caa479cbca90119329f8

SHA1
d80cc1cea5c6a385eb2a3fd05bcb52bc1c7da016

SHA256
4be76bc937fc2fbccec2a9eb78c25e4b34038dfbb471d1c8f909e6e3ef9c1ba4

SHA512
2bb9f78939bd72efb2323508ec22c15eaaf09a4c6b422e9060393fcc6d5f99102b16bb6eabf37ca08cb818caf92dd52e812a54d7a72e2c209a2b8d26a22910d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
f3862c4c4a6dbe9e18070d6dd21f5e6f

SHA1
72862df16021c99f2a7a20ebd395fefde15c1be0

SHA256
15b220e3b290802cdb8393dbf1874a50c0a7e4784f03553ecd13226fa34e0b56

SHA512
73499d59cc852ebc149e9e8f1b6bf88ebbbcda2efaad152cb6aca7677c6bb3e58dcd38680c2533ee81a5cc729819e306d8ca365008d84e964ea7562404edc12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73765df52835d1f3d24bd347a03bdfc1

SHA1
4972b585164daeadc92bc371860ac5f6e32f275c

SHA256
5b3006336e1e3a361c9e477a946e7e5dc5e435febe3dd4406d0a773cbc1455e3

SHA512
a96bfcdcf27796a6f97ddf8d15899f0a68135d3f8f23c821870291cf9fc24206eaf6c20bff8d16df76f4c4022c53e38d2cdd320e71ff605e21daddb4f754feca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b1a0b01faa8e447ee7c032d40756dbf

SHA1
2204863c46b0567909c795c76c121fd2b206dd97

SHA256
667dd53766c218e620f4cbb962520562382864a21cad7b315c2af070a3e3b294

SHA512
49b004087b27f42cc930dd9a12b1f0596e4542713dad9da925372ef2a4c71fef01845e242c4f2733af6764d10debdbadaf02b3ac35f3334523a1693234e2be55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
5cd23c8e9af344a40a9a1aedc97a57b8

SHA1
993746e9e2d9ec8848e19420e6ecb55ccefbbcc8

SHA256
6445a7060be957cf918b8bc00ca25ea651dff91670a3e85302d7413ae98ea476

SHA512
a1cfa6eb3f6bdcb08a3bd4784360cafcee8c365f409a4e4ca2dd713030cf605a39204774f83119f2621df7a87e9dfead2b4e1b38321856035fc26de7502f4848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
6728a77235aea0f583c59d132f88581f

SHA1
4de06e16904a5b16d84902ff0608327a2d7fe99b

SHA256
6e8ea2245eb3dd37b6f0149ba952f99b4a8cdfd5a13d3c682242f9611fbe748c

SHA512
0dc47fd02849d5a220c5f83e8abbdc9c59bb88eca4d513295d110cf890a40d8d56429bd8606c744ff922da30ab2fbc9babb88decf75132f32e107f972e0d82cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
f0fc1648004b2818c9e82c5acf92f203

SHA1
19174fc6823238b48d979e506dadda947a1b58b2

SHA256
1b8c716a98808f756713c493cac0f284940d95953bb018883f160825058ca1ff

SHA512
7be78476306b132de377dc1b4ba9a7060cb3a1a51990edf7f729aa2183dbffac0de7e397e99f0dd9759e15f19bcf1476d74899295baf0a885424bbffd14875ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
059290f0c89dae973d7a6aeb8a861568

SHA1
13d2add2b7b452310174d4ac72afb6610bba4bf1

SHA256
c8c5a3e1daa6330dce35b5426c8a0e3b7e2e39abc79404be72959f3b9d0f3959

SHA512
853a75556afcccc3ffefa18d8c6c11f73996fc20816690a8367c9aa0636e83b4910b00f9b381b362c20381d92bf2fcc105ffbe3cbb9b7592f8214eef63395b1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579f4d.TMP

Filesize
48B

MD5
f6d79c6cf1f965b3c6927106bfd387bd

SHA1
f1613b68754fadb15f45ba565a83733e1607cf32

SHA256
29479e5b93074363b5b02fb37f974308c07b3340450fd68070ea2d0da2af7690

SHA512
4cd679a31b94fa46ec448420d5ce75ea85bc1f19ef48f72b1918733eda94c9e0694c3bab54b747f3716af7db0965459bc915300c2c51e43f2855e99273e9b8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
10e6057aedccbeed167b450e7141d3d5

SHA1
460bed1c01cb6249c37f4068744ce928e3903a9c

SHA256
f3ae2bcf9c2e922b7e4468720cf2c602e86e1b789d2d8fa86cf3b93edb8bfc8c

SHA512
6a323a793e9c29fd376dbef8ad172fe377267204420890361c907d5df05520aaa3837ae436318e3cd664a90352c583b004caa22bf51ff4906e350fe3984143db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2f28568c7a2e8ae41a70dcd91ab09456

SHA1
a9d6143bac6b175e50f953f2dbef7521aa6fd7fa

SHA256
562c0a08ec2c3b3af58229ec8c164fbd91a30ff2b170a480de08ab04b29472a8

SHA512
561e1259e296037ee71cccf42f4be55c0fe7aeb41c181ea1424718a35bb3a966f38dc620b29e1fd07d01be792df2e8f6a7a3c19fa99d4a69152584d444b40ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
29009276dbdbe7d02f4353d54f3f4881

SHA1
8760fd86c44aaaacddd211f79c675c61666147d9

SHA256
e7376184868ed23ef4fec3ecd77f3d0a8b57941b28fdcac090364b3e61a6c834

SHA512
015918478df914e27468c01e9553a4d8fdcbfc369190ca49d7ebc399640abd9847eb333ce508cab17e688faafcc4695247c9cfaee92f5c551c94b91510c339eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
369140aa78dda39451e51b08522924a7

SHA1
f09ebf667c27454ca0a17f0ddd7aaf22690aed2e

SHA256
c65c244fd37f738684fcf85d4cce8f2650d07b83d47127e2422fd24d457aa9e6

SHA512
c33298e2887889a8cead595fdbe137b9b32146f516a37b4e4705484a8dc47c8bc2697894417c564348ca9311b0679dae36de634993b0b498574626dae4546515

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586925.TMP

Filesize
203B

MD5
08f1266c1fa05deaac11422199a6cafe

SHA1
aadb1ffcc6e5d92dce18ae72cf66e2307a7643d9

SHA256
a01004ac51e94471a2146bed51fbeea77dd7f9518396cf4838108c476ee7ac18

SHA512
576abb069b82e5c5f97e13e01b3df9e0469c254e37c370e9f55990d93a26473d4801abee5e760ae0ef2d70e5a675b25ad88619f9cc0361b9726e0a6dd725bf79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
58cfb58c4e3e8e6fad317b4030a35446

SHA1
f858b780e736d1a92eeb158d1cd2f955b9e76942

SHA256
289a4449e0a94e00bd50a9ec626ef7e500602ef10c26c28d6f9eb0bf33723540

SHA512
986f2e3a5a9871cf11f07e6776cca55161d7b79c879aab274da2812a7dc041f7990f96bb7cd1db67b2849008298ca826f1012571959729a10cb6fffccb379c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
851eb7eac553dfc52dd04cc71c9140ba

SHA1
338f0dc5d1c819c2b7578227f8a17f26ca8d4c1c

SHA256
b0f17bdb55452b3d827c6d25601f2578995347600a7bffbb6b5132c64e943566

SHA512
7b7b9e156b44b1d783d24ab5cd415e9ca634eefdd00d55175c8beb9c693f92dec1d1bce996d54d0294788b905c57e8d8be46ac07bbde6ab13b3d4e49b5cb4a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cbacb42a311462fe47dcf15c9d2a55a8

SHA1
2b97a7dcdd2ed1884fd726eaed00c6efffa65848

SHA256
c123b1bf2821267877da8b83807e79fae0c857e584db1291f9a2ef8998c18b0f

SHA512
6694a2a553f024a110d088512b9f7f0eca31d4d97b808c9524745006fe5c411b85632352e737f2d368b465107706c8e32b7eb6495ce396a461e82571d1b5d2c1

Download Submit
C:\Users\Admin\Downloads\Beasty Cracked.zip

Filesize
9.0MB

MD5
f09fec328e89a25558978a97f1fe7d88

SHA1
b2d25adb18f9bde39e238d69792ed87ab001d61c

SHA256
99cdab027866f7432c97c6557e9dc664f2adf78dcec6c734ad427b2dd5ceef23

SHA512
a6e563a4823dfa15e12bbed41fc997aac3d0055d937ebd44a8a85c8fe83cdd4a72b90674b665cf36634f8cdb43af120524b22c2269f6dbed9447026a1bb602b4

Download Submit
C:\Users\Admin\Downloads\d3dcompiler_43.zip

Filesize
906KB

MD5
a389a8e84447749fabe9a6284116f608

SHA1
aec515a5970b09a7341a5366c6d10968ce6a9c76

SHA256
dca69bd5bb280aba14fc1dac35abe2dde2da74d11e89573f3cc7eb03114c48bf

SHA512
200fbc0f6ce79b9c8e3629bc4cc757632a0b51afdf9369636d01e5fc3a2ff104f4d35a34e55ea1847245f2eeeea71a50de24d1c753cc048b5d7a1d024bcbf623

Download Submit