03d9251e58c56b0eab7b311cc1e63adcb614996f9f4b4593e11cc7ba7f2fe9d9

Analysis

max time kernel
250s
max time network
258s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Dan's Studio Report.png
Size

15KB
MD5

e06169482fc07f496a3e7f4396717fbe
SHA1

1d18535aa65e8046de3c7c1b1d48b3911f41471b
SHA256

03d9251e58c56b0eab7b311cc1e63adcb614996f9f4b4593e11cc7ba7f2fe9d9
SHA512

44ff0516efc0a4a534327d95988e2a1fcb1764f5352a05d83bc78da9a9daca8d77a9c43df781a3ce5f9e78577e41eae951ce5561d0f06c48a26d2be6ea4731eb
SSDEEP

384:TS+/Lvpvy4tuMFcBHVX5Xq+IZa0ACENTiPKUGI:TS+7JjtuGcB1X5aX8GwNpI

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2600	JJSploit_8.4.1_x64-setup (1).exe

Loads dropped DLL 4 IoCs

pid	Process
2600	JJSploit_8.4.1_x64-setup (1).exe
2600	JJSploit_8.4.1_x64-setup (1).exe
2600	JJSploit_8.4.1_x64-setup (1).exe
2600	JJSploit_8.4.1_x64-setup (1).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
158	raw.githubusercontent.com
157	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JJSploit_8.4.1_x64-setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{890F7A9F-72CB-11EF-B1C5-62A6B307388A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068fd66d6220e584abe447a4e1268eb5100000000020000000000106600000001000020000000fdb4d33a7e560f99f956ea6aeebdba446e891063f4d5ca21e0d56cd608490463000000000e8000000002000020000000fcab347c58294bb598fea3f2d17d418951740481e2339eeecd1bb57b8f3bd4ac200000000a9bb7fbd0e433ab70e40900bd3bef2a01bdc9c0f98e951887879b090899a19b400000003d136675e61010ddfd78856a28e600d8322171681e4c69256dbc11628580ec7e60e4d50d7b42b20c1609218426fab88a980bf750e75c08d3b9a3a227b47a3df0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80380f5ed806db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068fd66d6220e584abe447a4e1268eb510000000002000000000010660000000100002000000033f12a88804221e9d396d38f0572e6ad541ad47fb8ac64cc12b433c78588891f000000000e800000000200002000000022e02ec938aa988efb0370f6bd73272590296c0746d68030c1d6a61ef8cb6f6220000000df68f53d63cdaf3d9d841a1bbc394a667f16f538cc1dc8ef22082d5a0b0755f040000000595ecbaa95faafb3eb33e415351e705e2fb8d34f3084d133884cfcf97fc0a0395a3979568833bdd3828094008f548643944745bb3937484e4564967cf0b1e03f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1573212882"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31131352"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f3135ed806db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1573212882"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31131352"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{BF0FB174-EC01-45C3-855E-B79635C0A860}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 549982.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 981584.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4540	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
1072	msedge.exe
1072	msedge.exe
1108	identity_helper.exe
1108	identity_helper.exe
1244	msedge.exe
1244	msedge.exe
880	msedge.exe
880	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
4312	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4540	EXCEL.EXE
4312	iexplore.exe
4312	iexplore.exe
4564	IEXPLORE.EXE
4564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 952	1072	msedge.exe	96
PID 1072 wrote to memory of 952	1072	msedge.exe	96
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 2780	1072	msedge.exe	99
PID 1072 wrote to memory of 3768	1072	msedge.exe	100
PID 1072 wrote to memory of 3768	1072	msedge.exe	100
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101
PID 1072 wrote to memory of 2512	1072	msedge.exe	101

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dan's Studio Report.png"
1⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdb99646f8,0x7ffdb9964708,0x7ffdb9964718
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Users\Admin\Downloads\JJSploit_8.4.1_x64-setup (1).exe
  "C:\Users\Admin\Downloads\JJSploit_8.4.1_x64-setup (1).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16509607059265764122,9972020596298607240,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ResizeMove.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4540

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RestartUnpublish.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4312 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault159b1aa0hce5ch4193ha455he7990de66c53
1⤵
PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdb99646f8,0x7ffdb9964708,0x7ffdb9964718
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,3730438923749856065,4651134412240540838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,3730438923749856065,4651134412240540838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,3730438923749856065,4651134412240540838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
e8c0b3db73a4706830390539f17a186a

SHA1
6ea26b26baa7ffad6e600f2f11f08a27f29f6526

SHA256
8cf4cdebe12ee40deb93e8bc4bea7b3c3ecd1cc4327d035569c9fc7baf872286

SHA512
f174f694208767a6752a6b823c2a8dffcd2287189ef5e19bbb75cb08e70ea0a9ed69cf35aa2f05a89f9b42f26b81a2f2485059af511bad5dc371319b841a7546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
40b66d7c65cf1930c4350f4e01958fc9

SHA1
d12ba3a8bbf14aacf9ba0b629935aa54dba80875

SHA256
ada1b12846bc91f28505722f5b349e817f6a445de25e7758f8f89aa0cb35c7ff

SHA512
be8827bce2994be91e53dbacfcf0bdbe364993f3b9e53b67672b66011e9c4e255dfa682a43702dffa8f40f72678fb335dfa70bacb469a5d9c4771e07935b4abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
17d2ce0481b986f4c57fd8f58db1a7c6

SHA1
15f7ca575a4ee85a819bd6ced860725d345f2161

SHA256
ff65872e4cc71c78856cfb30b024f9355e94ebce30f9bb3a76e8f8afad17ec7f

SHA512
a4bff671c6269da42886159e5ef5aab490ee5a91e35d5030544ff40103e9c5e49e40c08289a88683e703ed6cbf10b24c825a428269713aa960595f7175007ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
71d5b6b4861b0e4e5f3cbe58f0faeb61

SHA1
44c20382736e2899e2c0566e90662cc1c3228ba4

SHA256
9a94a395bdb97b2067c5c66dc0774d6f4a6effd267bf96feda6ab6ea9fc0cc44

SHA512
0bc825e3ae3bbaf0e11a404d29eacf84667d08227b42bc871eb6ce260eb091172f2d1eb251043f9c0ea7dce4eecf3c4db83547e2ab66c467371213af0dfc65db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
70aba4ad2b395f297b59e2233f80aa87

SHA1
c563843e0d5fbc7c0d49dbe59d6d4509e894ac72

SHA256
a0df6ffb8f2cae6042fc38d8757d5810e41915fa9836ac7391de0ddc98cfc1b7

SHA512
eab0f9f677a5b188c770b750a8246675723054524cf365672c91368690ef935610c942345e4d4a2b3110d0ef84249a554175fe1369784499fbe3b0841d6ddaa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
5KB

MD5
7d164f7fbef1501f09c8d9147eddb3a4

SHA1
71991d169040b5beb0908ed37284a6469a15139f

SHA256
999234e7dfcfa81af472330aad081b4e69a5488fb89f61e37234dd18dd0f976a

SHA512
cd8c4364ab63af6430c7fe7689cf8600572ddf80f8df7aa38abd1a0c6e9d63869f413a1394d99e8d1e68ca70ef9ac2e60ae6e83f4b3a06605df58020ebf35c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
5a37deecb59d5dfddcf2f27f641f0f10

SHA1
2a081207fbbb717b94e98f6c3840c689159a2087

SHA256
8647f1826d0dd197abcfdc245da95fefd8a47c5a6b5babc53eeb614a8441e11b

SHA512
816c03dbed1c089f715fe5bc2a3c990ad9fea01986cf6183049975c06b0a0df9388ba9490c56d83296f98c7dd4c6f02548ae50ccc4a58a4b28a983eb04c75e0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
8ab2e6033d124428510bbd400aed028e

SHA1
e00151216016ef478967b90e39d010f508af6bed

SHA256
ac3034fa34b13fb8293ec133a32c89c7b5e6ab52428ea751bf0b8f3afd29911f

SHA512
577be6004ed08834291b2356c0d19743cbe2784ed1cf178cf7b900c8b290605cc33adc86a0a258f117325ba148241bb08a7a9c688b9eef8593a454d2548faa35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
1b0bc1fd30a19348c257e54f4c015959

SHA1
2718276c4adf9449a4d5ce0dd2c65bfe1a32b69e

SHA256
5f9754a2d5b0f8a5f9e8484f4693f9963f880b08d7e66e1932a2b2a4d50fc547

SHA512
59cd037a398f63b314ef4f4c3a8460a9dd0105f91e971b4eb5449a874ec451d5360f17e763956171a4a02b553c756382f4c0438dbe3aba4f7863b57161b3695e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
541B

MD5
52f6c71630d55381e5ac821193d17439

SHA1
7ac8c81f9110f19a9c23c4547931f4966ab7d5ff

SHA256
bb7586ddcd84408048a5f8c413d20f9b1e185ac240213bd30bc870c1b7086d92

SHA512
f30ddae1020ec7eedc084b22b9a5a553151697ada7d2df36bb626e0069d718c1bdf5de19eedabf22035fd9d813676c243f16537ca3d82c4f2c6648d4a3a8c61b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5df1a14d8c863cf185843bcb435ad102

SHA1
af813ba349ac3e4f343168c536d7dd22b50f0762

SHA256
8bacbf9b7024414eb98c88a2378f789b4a42064cc3fdd3d4e7ef52cdab0acf1b

SHA512
70318dfc64c58d0b15744db40b99116b8aa4523ecae377d297be13bef2d2b56a1e07e95f09dbd2498d59704b1898b030db9b426582b7e9379eb2517bc4828032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98bc0b86cf5330e183626121a576caa5

SHA1
59a56bc05d32149c7c2aeda16cef2f91664868f3

SHA256
a93780eadc001b8720f264da84cc6920d54691a41c4b15ebcc12079714c25cac

SHA512
91c9e85b92640d4c557fb962494e0609710da93cc26455a629cc3b0a6bea0ee532dd36520718e10a8e19e57013b43bda6986fd62349f08352c749e313f2068b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4f54c3f59bf162fa1250a1595bf68158

SHA1
08bbf765bcdfccb2649deb731381b5707f82657b

SHA256
c7b412526dbdccb581d1c7dae9fee9033bd685fdddca03357a680895206f4ba3

SHA512
c26e72eecb6970c9cf26888a62a3f604f05658754571df3578dd2b901d309b956d2d82201a3133116533d03272becf7ed3d52c2eeb22c37ea0014f49c3364511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2411f6967a404740bfadbfa78e39a391

SHA1
6750d6399b165fa2454ab062b9b409820bac685c

SHA256
5db85fdc09e22a62d0e14ce7978b38ddc4cf344b7650333c27c914a8c06fe1f9

SHA512
e2113e03ed8a4e61dca33c65ccd71672fcccb051e340668a8924a619750d06ef26522ac501401faf51f85ceb92c496fda5f9644746ec5721dd41dd608c462433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b9a119bd70d5d4abd7002c3a6ee269c3

SHA1
ddd16f3c1cab6f630fd56aeeca8b6b3733701336

SHA256
69b5bc2fd72df054c490cb91ae061415b34796bdcb1dda1664c5d0028acc6a00

SHA512
37b5a73a5d682497a5aadfd5bfe150f35d7fee135b489ff5365c2dc786ccd2729e1375ec7fbc6ed0eb0504fdd81df7ccbffdf2b1e3cd661977f46f66c07f36f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
0958fa3bc2b9cf201369dc80758f7995

SHA1
f12ad9040fb2d043601d341f9913362906468932

SHA256
bfcb311596fd9d548200792ca48878cab8105355b009b9c55ce9f9eb57588e78

SHA512
7cdc974a927fc876fcb2995be46587781c8077f6c7b676cd06b4759cd97df064aebb494db28bab0a13be1c0b3f4c6a0c43470d280354ca1f55dc452cc1cfa867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
1477e89c40e05aeb0af0472475e91cf8

SHA1
7bd7e3ce87d8c799786ca4dfb0d0cc4afe94384a

SHA256
d67c7f4bfc774b021a863fef489b393058c0f4a44fad7f7b5c96afd85c98b856

SHA512
a905a8324f4439c484e69e69ed6c29749eb203bf01a4449abd93513fa4c408f7b15ae319c3fb9d79d1481dbdedc7bb5f7f28a49614db1ea038d7b9791042da34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
ca822ba2081ebb3ec6bf3f3e1a90c473

SHA1
0bef642c240bb83e9c904b57e00134593c03d2c8

SHA256
c8302cf8c3e4459df54bdd9c295b35a3d0a4ae615d6d9acbd160ddf39288b680

SHA512
19fac55cdc94aa07705a0826d03f1bf2de2bdde6dc0429e1814847329f8069c56fae07dcbe5d70536d8aae85e1604cf63261c63c0d0081ce62852fba38af0bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
920d121907b07a2b705d2737adf131c5

SHA1
75eb8570115f4aee2268b10599ba95f0a8410191

SHA256
96975d2d0f3e4fc7d36deeb97d050e15fae1e31c9ba8e00740b2a300e0ce0532

SHA512
065525b0b773402a278ebdd580637b757eef6f0e938da0ebd81a6ab42cd71a9f48680a99d4c2ee30b88a9c1d9a3ce50e4ba8ef4aba5173195c21563664812cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
37d71426744376a77e9ece4f150f5e85

SHA1
006a1e399260048569021fd98e895a6e2039bf6a

SHA256
103503238b1bcd9d96820a195695b95e51ae321cae377d2f72e546f56c86377f

SHA512
81ed98c8f1600eef25b6651a63647d33ea6924f84570209b01270824dbea88212fe07d675ef0a0c83ab15e56dc975e60dc7d9ad6d5f1c79d94060ab11f5b2646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c687.TMP

Filesize
538B

MD5
3353dfff457ad3c576a90799cf5d2b3f

SHA1
70837fa389e6b968d2284c3c3bec9c7f32671cfd

SHA256
ab448a3e97e5173c151d4e697cf2bc48d7d50f7dd1d6c680b12672e816540f49

SHA512
2e4e00d71c065cee50b51cb0cbdf019863a9f8a767d1be93adb96f02ee618eba666f088630463cf6f05bc9cd949cb13e6a7e4b5b030b1e5147d324dbd37f0fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
bf4a4a3e7c70f03af905b311fb324445

SHA1
5157d21bcf76290c44419a411f86bb382a5d59c3

SHA256
a636286f4dfe7826f324b3ad761ebeac918d337c7e035aaa1f3f74008191b1fd

SHA512
f9a8b0ebd9e31fa7b2d70bc14554a84c0ecae6c47e7fe74315b7cde66acde1847e39ee17c6951660c9216115215ce2d202d7f9398a23ff75ae4d210e997cbda4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
927d307dac3abaee79f12f8e723c9d18

SHA1
df3ee7578a088658ec0ed63e7f63ce1293fa131d

SHA256
d8c1a1a2e651ec82f9b8f3d399df3e509ed2d6d3f49d83eb5a92de82338f652a

SHA512
62372bb9f3c7557d3c5e1384f483d620bb6d5745cc9aabba4285cec4a2f8086e556e6429a3687b36d7c42cf2a215c8ee687870e1125ff2a48f2edc08789b9e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
15c7ea4c59ee9095ea60719d7558503f

SHA1
c0ca4aadbd1dfc2f89b4c3fe28796b85e1f85d30

SHA256
2a5cd1f5e8a48667dee7e9c37469dcf39affb71349d202a797f09b3814569fa7

SHA512
fd1483968ae9c79df7aa6028cea6b6e2b9773e4479a58c3554da9c495a5012f66f90d97c8595c5cb0c23396598214248ece36a78a7858376bbd5da52f29bd5c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50eba8c144840b09c68ad69230c2543e

SHA1
a1f832bfd666ff89a68a9908a711ba3410770f3a

SHA256
fdf6ddc9b1c1a7cfc35cf3abfb777960a840f9b100a509c8d7a6addae88034fa

SHA512
99f93a8bef76e6922326747001d72a903b71498560a4d5c89fa356c849be846bd2816c8ee4096051a8eeb4ab963fcb56dede711930e967842b5ebc943523a2dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
62c8e1478ee4a5066fc256f347c808d3

SHA1
ce4afb8fd0748ee25fcd3d6ab8a8a3caae023d5c

SHA256
04c6544eba172b10fd93bef2f7b567e4695f33b5e275fe2aa524ab0201a6126f

SHA512
4f396ccaefb3708230cca5325d1dfa0f396f8a7f2154e64e642eeca81cb956d4235e5c02aa41c474dbded6ced2b163503d73504702b2f2ff779bad2da0e09474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4bfc1a5678ec8e170ce56f175e2d3797

SHA1
51fb5b5bcf1d43748ff939b53375ce3c3f21d2e5

SHA256
39fc00f944a99c75a2b074d2f6e748450f8a8fc41185473df1916e72d9d3e45e

SHA512
eb31b1d83537d1f20f3d68a1bb80db275fe9cd42d541cc54821a86efd3d89842432536d286f8cdb47a4f3e97f0c13066ed16a7d831fdfec449e110d6fd1ce044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
40369a57458de8da2e5a304c9c8c40ca

SHA1
f79505c4b85b2bf8e3557a530781cf5d55517258

SHA256
04978cb61184d50dbfebf55689bb390a35f12b041ca10d8da5085e55d4f72db4

SHA512
810bd70a771f586f01e6593e6263fe4145431fccd35517cd53fe3e0d8a7cb3e89b7fdcb2b37c64dac7ea606766017524c565a95c5dc48de15df328055a84e985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
bcd79590e6cd75eae43c4ac46d81105c

SHA1
e677f2ebd09a2645dfa752a4d4f2ee8482a8dfb7

SHA256
1bdfbc80e31d26eb4226464e8124a5b3079d9d2e7f1b81c55ea73b0958dd8989

SHA512
b3ba37e1748bcbc798560e1f661d65baa0b9b425d338d51cafc93983d335e788a0bb4990650338429aa5f0439398f933002372c7e97cbdbbaf60f3e30a4a2dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
879ee74709623bc839e8203cf0b56681

SHA1
9e447c6cd14ce51f7df9b38d11c98267c6079259

SHA256
190c47dd47992f82998a7faec500b1ba85c02568b285032d730fe9712951f2b2

SHA512
7d4f152552dc538fb380ac4dbffde69328d653a54deae7778240b009ca84f0485ee01c2283def7b4f889727bc0d6447eb34150fc05fbaacebe277a2edd65bb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso2534.tmp\NSISdl.dll

Filesize
15KB

MD5
ee68463fed225c5c98d800bdbd205598

SHA1
306364af624de3028e2078c4d8c234fa497bd723

SHA256
419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

SHA512
b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso2534.tmp\StartMenu.dll

Filesize
7KB

MD5
d070f3275df715bf3708beff2c6c307d

SHA1
93d3725801e07303e9727c4369e19fd139e69023

SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso2534.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso2534.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso2534.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
321B

MD5
b3184a663010656f601d3a8ec014d53b

SHA1
d9a1795d91a81ee8b6eaeb52d03765a9c796a74d

SHA256
4bce21f882c2d66b8c036a6e06d8c45d05f9aba19679a724c91f42bd5d7d440c

SHA512
e065c89d7335bba6ca8ed42d3bd0dbac1f06e55422142c5380eadbbea42f9a3f46e702ce376309a207f30c247fd71204537470a17be2426e8c2c304d698c9748

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 549982.crdownload

Filesize
6.0MB

MD5
6818667184b5932f3e4f554ed1075fe8

SHA1
59a7a5715bf48d4346eaa4a5ce93a87e15adac71

SHA256
fe43c0daebace84ed84884b877150d609199c13d0ba9254d35a0d305f4f42440

SHA512
4b3a900472b204134d8c9f0ca82b78390ae92557594ed65c514c79664e82fcb9f587fed8a790cee1b6497eb616c4d4dcdcbb5d19de1c6fde01223dadfbd9f665

Download Submit
memory/4540-658-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-701-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-702-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-700-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-699-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-662-0x00007FFD95CB0000-0x00007FFD95CC0000-memory.dmp

Filesize
64KB

Download
memory/4540-661-0x00007FFD95CB0000-0x00007FFD95CC0000-memory.dmp

Filesize
64KB

Download
memory/4540-657-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-660-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-659-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download
memory/4540-656-0x00007FFD97EB0000-0x00007FFD97EC0000-memory.dmp

Filesize
64KB

Download